CVE-2013-2488 — Improper Input Validation in Wireshark

CWE-20 — Improper Input Validation8 documents6 sources
Severity
5.0MEDIUMNVD
EPSS
3.6%
top 12.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
WiresharkDebian WiresharkDebian Linux+1 more
Timeline
PublishedMar 7
Latest updateMay 14

Description

The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment offset before invoking the reassembly state machine, which allows remote attackers to cause a denial of service (application crash) via a large offset value that triggers write access to an invalid memory location.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages4 packages

▶debiandebian/wireshark< wireshark 1.8.2-5 (bookworm)
▶Debianwireshark/wireshark< 1.8.2-5+3
▶NVDwireshark/wireshark20 versions+19
▶NVDopensuse/opensuse4 versions+3

Also affects: Debian Linux 7.0

🔴Vulnerability Details

2
GHSA
GHSA-pcxx-29j4-gxjh: The DTLS dissector in Wireshark 1↗2022-05-14
▶
OSV
CVE-2013-2488: The DTLS dissector in Wireshark 1↗2013-03-07
▶

📋Vendor Advisories

2
Red Hat
wireshark: Crash in the DTLS dissector (wnpa-sec-2013-22, upstream bug 8380)↗2013-03-06
▶
Debian
CVE-2013-2488: wireshark - The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does ...↗2013
▶

💬Community

3
Bugzilla
CVE-2013-2478 CVE-2013-2480 CVE-2013-2481 CVE-2013-2482 CVE-2013-2483 CVE-2013-2484 CVE-2013-2485 CVE-2013-2488 wireshark various flaws [fedora-17]↗2013-03-08
▶
Bugzilla
wireshark various flaws (fixed in upstream 1.8.6 version) [fedora-18]↗2013-03-08
▶
Bugzilla
CVE-2013-2488 wireshark: Crash in the DTLS dissector (wnpa-sec-2013-22, upstream bug 8380)↗2013-03-07
▶