Vulnerability Details : CVE-2013-4076
Buffer overflow in the dissect_iphc_crtp_fh function in epan/dissectors/packet-ppp.c in the PPP dissector in Wireshark 1.8.x before 1.8.8 allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2013-4076
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.6:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.8.7:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-4076
0.22%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 59 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-4076
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2013-4076
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-4076
-
http://www.gentoo.org/security/en/glsa/glsa-201308-05.xml
Wireshark: Multiple vulnerabilities (GLSA 201308-05) — Gentoo security
-
http://anonsvn.wireshark.org/viewvc?view=revision&revision=46128
code.wireshark Code Review - wireshark.git/tree
-
http://lists.opensuse.org/opensuse-updates/2013-06/msg00194.html
openSUSE-SU-2013:1084-1: moderate: update for wireshark
-
http://www.wireshark.org/security/wnpa-sec-2013-34.html
Wireshark · wnpa-sec-2013-34 · PPP dissector crashVendor Advisory
-
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7880
7880 – Buildbot crash output: fuzz-2012-10-19-28735.pcapVendor Advisory
-
http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-ppp.c?r1=46128&r2=46127&pathrev=46128
code.wireshark Code Review - wireshark.git/tree
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16676
Repository / Oval Repository
-
http://www.wireshark.org/docs/relnotes/wireshark-1.8.8.html
Wireshark · Wireshark 1.8.8 Release NotesVendor Advisory
-
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8727
8727 – tvbuff.c crashVendor Advisory
-
http://www.debian.org/security/2013/dsa-2709
Debian -- Security Information -- DSA-2709-1 wireshark
-
http://lists.opensuse.org/opensuse-updates/2013-06/msg00196.html
openSUSE-SU-2013:1086-1: moderate: wireshark
Jump to