PT-2019-5385 · Wireshark+2 · Wireshark+2

Published 2019-04-09 · Updated 2024-06-15 · CVE-2019-10902

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Wireshark version 3.0.0

Description The issue is related to the TSDNS dissector in Wireshark, which could crash due to errors in resource management. This could potentially allow a remote attacker to cause a denial of service. The problem was addressed by safely splitting strings in the dissector code.

Recommendations For Wireshark version 3.0.0, update the epan/dissectors/packet-tsdns.c file to include the fix that splits strings safely to prevent crashes.

Exploit

Fix

Unchecked Return Value

Weakness Enumeration

CWE-399

CWE-252

Related Identifiers

ALT-PU-2019-1633

BDU:2020-02716

CVE-2019-10902

OPENSUSE-SU-2020:0362-1

OPENSUSE-SU-2020_0362-1

OPENSUSE-SU-2024:11513-1

SUSE-SU-2020:0693-1

Affected Products

Alt Linux

Suse

Wireshark

References · 355

• 🔥 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15619 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LYIOOQIMFQ3PA7AFBK4DNXHISTEYUC5 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02574 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00215 · Security Note
• https://wireshark.org/security/wnpa-sec-2019-16.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00959 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10899 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10896 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10902 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00253 · Security Note
• https://bdu.fstec.ru/vul/2021-01496 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:0362-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10900 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:0693-1 · Vendor Advisory