Vulnerability Details : CVE-2018-14343
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ASN.1 BER dissector could crash. This was addressed in epan/dissectors/packet-ber.c by ensuring that length values do not exceed the maximum signed integer.
Vulnerability category: Overflow
Products affected by CVE-2018-14343
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-14343
0.84%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 73 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-14343
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2018-14343
-
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-14343
-
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
[security-announce] openSUSE-SU-2020:0362-1: moderate: Security update f
-
http://www.securitytracker.com/id/1041608
Wireshark Bugs in Multiple Dissectors Let Remote Users Cause the Application to Crash or Consume Excessive CPU Resources - SecurityTrackerThird Party Advisory;VDB Entry
-
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14682
14682 – [oss-fuzz] ASAN: heap-buffer-overflow epan/dissectors/packet-ber.c:3988:17 in dissect_ber_constrained_bitstringIssue Tracking;Vendor Advisory
-
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=9402f2f80c6bc7d25178a0875c5a1f5ee36361db
code.wireshark Code Review - wireshark.git/commitPatch;Vendor Advisory
-
http://www.securityfocus.com/bid/104847
Wireshark Multiple Denial of Service VulnerabilitiesThird Party Advisory;VDB Entry
-
https://lists.debian.org/debian-lts-announce/2018/07/msg00045.html
[SECURITY] [DLA 1451-1] wireshark security updateMailing List;Third Party Advisory
-
https://www.wireshark.org/security/wnpa-sec-2018-37.html
Wireshark · wnpa-sec-2018-37 · ASN.1 BER and related dissectors crash.Vendor Advisory
Jump to