Vulnerability Details : CVE-2015-8740
The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number of columns, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
Vulnerability category: OverflowInput validationDenial of service
Products affected by CVE-2015-8740
- cpe:2.3:a:wireshark:wireshark:2.0.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-8740
0.31%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 66 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-8740
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST | |
5.3
|
MEDIUM | CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
1.6
|
3.6
|
NIST |
CWE ids for CVE-2015-8740
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-8740
-
http://www.securityfocus.com/bid/79382
Wireshark Multiple Security Vulnerabilities
-
https://security.gentoo.org/glsa/201604-05
Wireshark: Multiple vulnerabilities (GLSA 201604-05) — Gentoo security
-
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=e78093f69f1e95df919bbe644baa06c7e4e720c0
code.wireshark Code Review - wireshark.git/commit
-
http://www.wireshark.org/security/wnpa-sec-2015-58.html
Wireshark · wnpa-sec-2015-58 · TDS dissector crashVendor Advisory
-
http://www.securitytracker.com/id/1034551
Wireshark Multiple Dissector/Parser Bugs Let Remote Users Deny Service - SecurityTracker
-
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11846
11846 – Wireshark stack-based buffer overflow in dissect_tds7_colmetadata_token
Jump to