PT-2018-18059 · Wireshark+2 · Wireshark+2

Jakub Zawadzki · Published 2018-02-23 · Updated 2024-06-15 · CVE-2018-7419

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wireshark versions 2.2.0 through 2.2.12 Wireshark versions 2.4.0 through 2.4.4

Description The NBAP dissector in Wireshark could crash due to incorrect initialization of the DCH ID. This issue allows attackers to cause a denial of service by using a malformed packet trace file.

Recommendations For Wireshark versions 2.2.0 through 2.2.12, update the nbap.cnf file in epan/dissectors/asn1/nbap/ to ensure DCH ID initialization. For Wireshark versions 2.4.0 through 2.4.4, update the nbap.cnf file in epan/dissectors/asn1/nbap/ to ensure DCH ID initialization. As a temporary workaround, consider disabling the NBAP dissector until a patch is available.

Fix

DoS

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

ALT-PU-2018-1290

ALT-PU-2018-2487

CVE-2018-7419

DLA-1353-1

DSA-4217-1

MGASA-2018-0151

OPENSUSE-SU-2024:11513-1

SUSE-SU-2018:0811-1

SUSE-SU-2018:0867-1

Affected Products

Alt Linux

Suse

Wireshark

References · 332

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7321 · Security Note
• https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14443 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7323 · Security Note
• https://debian.org/security/2018/dsa-4217 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7419 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9347 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7328 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7325 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11354 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9345 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7330 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11406 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14367 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14370 · Security Note
• https://wireshark.org/security/wnpa-sec-2018-14.html · Vendor Advisory