Vulnerability Details : CVE-2013-3555
epan/dissectors/packet-gtpv2.c in the GTPv2 dissector in Wireshark 1.8.x before 1.8.7 calls incorrect functions in certain contexts related to ciphers, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Vulnerability category: Input validationDenial of service
Products affected by CVE-2013-3555
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.6:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-3555
0.65%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 77 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-3555
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2013-3555
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-3555
-
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8493
8493 – Buildbot crash output: randpkt-2013-03-18-26023.pcapExploit
-
http://lists.opensuse.org/opensuse-updates/2013-06/msg00048.html
openSUSE-SU-2013:0911-1: moderate: update for wireshark
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16779
Repository / Oval Repository
-
http://www.wireshark.org/security/wnpa-sec-2013-24.html
Wireshark · wnpa-sec-2013-24 · GTPv2 dissector crashVendor Advisory
-
http://www.gentoo.org/security/en/glsa/glsa-201308-05.xml
Wireshark: Multiple vulnerabilities (GLSA 201308-05) — Gentoo security
-
http://lists.opensuse.org/opensuse-updates/2013-06/msg00194.html
openSUSE-SU-2013:1084-1: moderate: update for wireshark
-
http://lists.opensuse.org/opensuse-updates/2013-06/msg00083.html
openSUSE-SU-2013:0947-1: moderate: update for wireshark
-
http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-gtpv2.c?r1=48393&r2=48392&pathrev=48393
code.wireshark Code Review - wireshark.git/treePatch
-
http://anonsvn.wireshark.org/viewvc?view=revision&revision=48393
code.wireshark Code Review - wireshark.git/treePatch
-
http://www.debian.org/security/2013/dsa-2700
Debian -- Security Information -- DSA-2700-1 wireshark
-
http://lists.opensuse.org/opensuse-updates/2013-06/msg00196.html
openSUSE-SU-2013:1086-1: moderate: wireshark
Jump to