CVE-2020-9430 — Improper Input Validation in Wireshark

CWE-20 — Improper Input ValidationCWE-125 — Out-of-bounds Read7 documents6 sources
Severity
7.5HIGHNVD
EPSS
3.6%
top 12.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
WiresharkDebian WiresharkDebian Linux+2 more
Timeline
PublishedFeb 27
Latest updateMay 24

Description

In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMAP dissector could crash. This was addressed in plugins/epan/wimax/msg_dlmap.c by validating a length field.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/wireshark< wireshark 3.2.2-1 (bookworm)
▶Debianwireshark/wireshark< 3.2.2-1+3
▶NVDwireshark/wireshark2.6.0 — 2.6.14+2
▶NVDopensuse/leap15.1

Also affects: Debian Linux 9.0, Fedora 30, 31, 32

🔴Vulnerability Details

2
GHSA
GHSA-f533-6h52-99jc: In Wireshark 3↗2022-05-24
▶
OSV
CVE-2020-9430: In Wireshark 3↗2020-02-27
▶

📋Vendor Advisories

2
Red Hat
wireshark: injecting a malformed packet may cause WiMax DLMAP dissector to crash due to out-of-bound read↗2020-02-26
▶
Debian
CVE-2020-9430: wireshark - In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMA...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-9430 wireshark: injecting a malformed packet may cause WiMax DLMAP dissector to crash due to out-of-bound read↗2020-03-18
▶
Bugzilla
CVE-2020-9430 wireshark: injecting a malformed packet may cause WiMax DLMAP dissector to crash due to out-of-bound read [fedora-all]↗2020-03-18
▶