PT-2018-2539 · Wireshark+4 · Wireshark+4

Published 2018-04-03 · Updated 2024-06-15 · CVE-2018-19622

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wireshark versions 2.4.0 through 2.4.10 Wireshark versions 2.6.0 through 2.6.4

Description The issue is related to the MMSE dissector in Wireshark, which can enter an infinite loop. This can be exploited by a remote attacker to cause a denial of service, specifically by exhausting CPU resources.

Recommendations For Wireshark versions 2.4.0 through 2.4.10, update to a version where the length overflows in the MMSE dissector are prevented. For Wireshark versions 2.6.0 through 2.6.4, update to a version where the length overflows in the MMSE dissector are prevented. As a temporary workaround, consider disabling the MMSE dissector until a patch is available.

Exploit

Fix

Infinite Loop

Resource Exhaustion

Weakness Enumeration

CWE-835

CWE-400

Related Identifiers

ALT-PU-2018-1549

ALT-PU-2018-2763

BDU:2019-00924

CESA-2020_1047

CVE-2018-19622

DLA-1634-1

DSA-4359-1

OPENSUSE-SU-2018_4307-1

OPENSUSE-SU-2020:0362-1

OPENSUSE-SU-2020_0362-1

OPENSUSE-SU-2024:11513-1

RHSA-2020:1047

RHSA-2020_1047

SUSE-SU-2018:4295-1

SUSE-SU-2018:4298-1

SUSE-SU-2018_4295-1

SUSE-SU-2018_4298-1

SUSE-SU-2020:0693-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Wireshark

References · 482

• 🔥 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15250 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7747 · Security Note
• https://bdu.fstec.ru/vul/2019-01559 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10903 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7746 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7323 · Security Note
• https://bdu.fstec.ru/vul/2022-00215 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9272 · Security Note
• https://wireshark.org/security/wnpa-sec-2018-54.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9258 · Security Note
• https://bdu.fstec.ru/vul/2022-00269 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:0693-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02571 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7325 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9766 · Security Note