製品・ソフトウェアに関する情報

JVN脆弱性詳細

Wireshark における入力確認に関する脆弱性

Title	Wireshark における入力確認に関する脆弱性
Summary	Wireshark には、入力確認に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 攻撃が行われる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 8, 2017, midnight
Registration Date	May 11, 2017, 2:02 p.m.
Last Update	May 11, 2017, 2:02 p.m.

Affected System

Wireshark

Wireshark 2.0.0 から 2.0.11

Wireshark 2.2.0 から 2.2.5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-7703	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7703
National Vulnerability Database (NVD)
2	CVE-2017-7703	https://nvd.nist.gov/vuln/detail/CVE-2017-7703

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Code Review
1	imap: Give correct lineend to get_token_len()	https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=671e32820ab29d41d712cc8a472eab9b672684d9
Wireshark Bug Database
2	Bug 13466	https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13466
Wireshark Security Advisories
3	wnpa-sec-2017-12	https://www.wireshark.org/security/wnpa-sec-2017-12.html

Change Log

No	Changed Details	Date of change
0	[2017年05月11日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2017-7703

Summary	In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the IMAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-imap.c by calculating a line's end correctly.
Publication Date	April 13, 2017, 8:59 a.m.
Registration Date	Jan. 26, 2021, 1:29 p.m.
Last Update	Nov. 21, 2024, 12:32 p.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/97636	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/97636	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1038262	Third Party Advisory VDB Entry
4	http://www.securitytracker.com/id/1038262	Third Party Advisory VDB Entry
5	https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13466	Issue Tracking Patch Vendor Advisory
6	https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13466	Issue Tracking Patch Vendor Advisory
7	https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=671e32820ab29d41d712cc8a472eab9b672684d9
8	https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=671e32820ab29d41d712cc8a472eab9b672684d9
9	https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html	Mailing List Third Party Advisory
10	https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html	Mailing List Third Party Advisory
11	https://security.gentoo.org/glsa/201706-12	Third Party Advisory
12	https://security.gentoo.org/glsa/201706-12	Third Party Advisory
13	https://www.wireshark.org/security/wnpa-sec-2017-12.html	Vendor Advisory
14	https://www.wireshark.org/security/wnpa-sec-2017-12.html	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-74	インジェクション	https://cwe.mitre.org/data/definitions/74.html