CVE-2008-3932 — Improper Input Validation in Wireshark

CWE-20 — Improper Input ValidationCWE-835 — Infinite Loop6 documents6 sources
Severity
5.0MEDIUMNVD
EPSS
0.7%
top 27.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WiresharkDebian Wireshark
Timeline
PublishedSep 4
Latest updateMay 2

Description

Wireshark (formerly Ethereal) 0.9.7 through 1.0.2 allows attackers to cause a denial of service (hang) via a crafted NCP packet that triggers an infinite loop.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/wireshark< wireshark 1.0.3-1 (bookworm)
▶Debianwireshark/wireshark< 1.0.3-1+3
▶NVDwireshark/wireshark29 versions+28

Patches

Patch: www.wireshark.org ↗Patch: www.wireshark.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-4xjr-qxq2-fwg7: Wireshark (formerly Ethereal) 0↗2022-05-02
▶
OSV
CVE-2008-3932: Wireshark (formerly Ethereal) 0↗2008-09-04
▶

📋Vendor Advisories

2
Red Hat
wireshark: infinite loop in the NCP dissector↗2008-09-03
▶
Debian
CVE-2008-3932: wireshark - Wireshark (formerly Ethereal) 0.9.7 through 1.0.2 allows attackers to cause a de...↗2008
▶

💬Community

1
Bugzilla
CVE-2008-3932 wireshark: infinite loop in the NCP dissector↗2008-09-05
▶