CVE-2018-14438 — Improper Input Validation in Wireshark

CWE-20 — Improper Input ValidationCWE-284 — Improper Access Control7 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 68.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WiresharkDebian Wireshark
Timeline
PublishedJul 20
Latest updateMay 14

Description

In Wireshark through 2.6.2, the create_app_running_mutex function in wsutil/file_util.c calls SetSecurityDescriptorDacl to set a NULL DACL, which allows attackers to modify the access control arbitrarily.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶Ubuntuwireshark/wireshark< 2.6.3-1~ubuntu14.04.1+2

🔴Vulnerability Details

2
GHSA
GHSA-jvmf-8grh-h7xw: In Wireshark through 2↗2022-05-14
▶
OSV
CVE-2018-14438: In Wireshark through 2↗2018-07-20
▶

📋Vendor Advisories

2
Red Hat
wireshark: Improper Access Control in create_app_running_mutex function in wsutil/file_util.c↗2018-06-28
▶
Debian
CVE-2018-14438: wireshark - In Wireshark through 2.6.2, the create_app_running_mutex function in wsutil/file...↗2018
▶

💬Community

2
Bugzilla
CVE-2018-14438 wireshark: Improper Access Control in create_app_running_mutex function in wsutil/file_util.c↗2018-07-30
▶
Bugzilla
CVE-2018-14438 wireshark: Improper Access Control in create_app_running_mutex function in wsutil/file_util.c [fedora-all]↗2018-07-30
▶