CVE-2017-9353 : In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed

In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed in epan/dissectors/packet-ipv6.c by validating an IPv6 address.

Published 2017-06-02 05:29:01

Updated 2019-03-20 13:50:10

Source MITRE

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2017-9353

Wireshark » Wireshark
Versions from including (>=) 2.2.0 and up to, including, (<=) 2.2.6
cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

1.61%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 87 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1303

1303 - wireshark: Crash in in6_is_addr_multicast - oss-fuzz - Monorail
Issue Tracking;Third Party Advisory
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=40b2d475c2ad550c1a0f536d5eb30f2a7404c4f0

code.wireshark Code Review - wireshark.git/commit
Issue Tracking;Patch;Vendor Advisory
http://www.securitytracker.com/id/1038612

Wireshark Multiple Dissector Bugs Lets Remote Users Deny Service - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
https://www.exploit-db.com/exploits/42123/

Wireshark 2.2.6 - IPv6 Dissector Denial of Service
Exploit;Third Party Advisory;VDB Entry
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13675

13675 – [oss-fuzz] UBSAN: member access within null pointer of type 'const struct e_in6_addr' in inet_ipv6.h:111:15
Issue Tracking;Patch;Vendor Advisory
http://www.securityfocus.com/bid/98805

Wireshark 'epan/dissectors/packet-ipv6.c' Denial of Service Vulnerability
Third Party Advisory;VDB Entry
https://www.wireshark.org/security/wnpa-sec-2017-33.html

Wireshark · wnpa-sec-2017-33 · IPv6 dissector crash
Vendor Advisory

Jump to