PT-2020-6575 · Wireshark+5 · Wireshark+5

Xfwang · Published 2020-05-19 · Updated 2024-06-15 · CVE-2020-13164

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wireshark versions 2.6.0 through 2.6.16 Wireshark versions 3.0.0 through 3.0.10 Wireshark versions 3.2.0 through 3.2.3

Description The issue is related to uncontrolled recursion in the NFS dissector, which could allow a remote attacker to cause a denial of service. The problem occurs due to excessive recursion, such as when encountering a cycle in the directory graph on a filesystem. This can lead to a crash of the NFS dissector.

Recommendations For Wireshark versions 2.6.0 through 2.6.16, update the epan/dissectors/packet-nfs.c file to prevent excessive recursion. For Wireshark versions 3.0.0 through 3.0.10, update the epan/dissectors/packet-nfs.c file to prevent excessive recursion. For Wireshark versions 3.2.0 through 3.2.3, update the epan/dissectors/packet-nfs.c file to prevent excessive recursion. As a temporary workaround, consider disabling the NFS dissector until a patch is available.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

ALT-PU-2020-2005

ALT-PU-2020-2029

BDU:2022-00277

CVE-2020-13164

DLA-2547-1

OPENSUSE-SU-2020:1188-1

OPENSUSE-SU-2020:1199-1

OPENSUSE-SU-2020_1188-1

OPENSUSE-SU-2020_1199-1

OPENSUSE-SU-2024:11513-1

SUSE-SU-2020:2144-1

USN-6262-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Suse

Ubuntu

Wireshark

References · 202

• https://osv.dev/vulnerability/CVE-2020-13164 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15466 · Vendor Advisory
• https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16476 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2144-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00026.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-17498 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00277 · Security Note
• https://security.gentoo.org/glsa/202007-13 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1199-1 · Vendor Advisory
• https://wireshark.org/security/wnpa-sec-2020-08.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5UOISPQTRCZGQLKBVXEDL72AEXEHS425 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25862 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13164 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNV3EYL4JBWCR22TJO3PH7ADUVS5RWSU · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13164 · Security Note