NVD Vulnerability Detail

CVE-2013-2488

Summary	The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment offset before invoking the reassembly state machine, which allows remote attackers to cause a denial of service (application crash) via a large offset value that triggers write access to an invalid memory location.
Publication Date	March 8, 2013, 12:55 a.m.
Registration Date	Jan. 26, 2021, 3:38 p.m.
Last Update	Nov. 21, 2024, 10:51 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://anonsvn.wireshark.org/viewvc?view=revision&revision=48011	Vendor Advisory
2	http://anonsvn.wireshark.org/viewvc?view=revision&revision=48011	Vendor Advisory
3	http://lists.opensuse.org/opensuse-updates/2013-03/msg00065.html
4	http://lists.opensuse.org/opensuse-updates/2013-03/msg00065.html
5	http://lists.opensuse.org/opensuse-updates/2013-03/msg00077.html
6	http://lists.opensuse.org/opensuse-updates/2013-03/msg00077.html
7	http://secunia.com/advisories/52471
8	http://secunia.com/advisories/52471
9	http://www.debian.org/security/2013/dsa-2644
10	http://www.debian.org/security/2013/dsa-2644
11	http://www.wireshark.org/docs/relnotes/wireshark-1.6.14.html	Vendor Advisory
12	http://www.wireshark.org/docs/relnotes/wireshark-1.6.14.html	Vendor Advisory
13	http://www.wireshark.org/docs/relnotes/wireshark-1.8.6.html	Vendor Advisory
14	http://www.wireshark.org/docs/relnotes/wireshark-1.8.6.html	Vendor Advisory
15	http://www.wireshark.org/security/wnpa-sec-2013-22.html	Vendor Advisory
16	http://www.wireshark.org/security/wnpa-sec-2013-22.html	Vendor Advisory
17	https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8380
18	https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8380
19	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16672
20	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16672

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

Wireshark の DTLS 解析機能におけるサービス運用妨害 (DoS) の脆弱性

Title	Wireshark の DTLS 解析機能におけるサービス運用妨害 (DoS) の脆弱性
Summary	Wireshark の DTLS 解析機能は、再構成状態にあるマシン (reassembly state machine) を起動する前に、フラグメントオフセットを検証しないため、サービス運用妨害 (アプリケーションクラッシュ) 状態となる脆弱性が存在します。
Possible impacts	第三者により、無効なメモリロケーションへの書き込みアクセスを誘発する過度に大きなオフセット値を介して、サービス運用妨害 (アプリケーションクラッシュ) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 6, 2013, midnight
Registration Date	March 11, 2013, 4:45 p.m.
Last Update	Aug. 5, 2013, 5:02 p.m.

Affected System

Wireshark

Wireshark 1.6.14 未満の 1.6.x

Wireshark 1.8.6 未満の 1.8.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-2488	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2488
National Vulnerability Database (NVD)
2	CVE-2013-2488	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2488

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-2644	http://www.debian.org/security/2013/dsa-2644
opensuse-updates
2	openSUSE-SU-2013:0494	http://lists.opensuse.org/opensuse-updates/2013-03/msg00065.html
3	openSUSE-SU-2013:0506	http://lists.opensuse.org/opensuse-updates/2013-03/msg00077.html
Wireshark
4	Revision 48011	http://anonsvn.wireshark.org/viewvc?view=revision&revision=48011
5	Wireshark 1.6.14 Release Notes	http://www.wireshark.org/docs/relnotes/wireshark-1.6.14.html
6	Wireshark 1.8.6 Release Notes	http://www.wireshark.org/docs/relnotes/wireshark-1.8.6.html
Wireshark Bug Database
7	Bug 8380	https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8380
Wireshark Security Advisories
8	wnpa-sec-2013-22	http://www.wireshark.org/security/wnpa-sec-2013-22.html

Change Log

No	Changed Details	Date of change
0	[2013年03月11日] 掲載 [2013年04月24日] ベンダ情報：openSUSE (openSUSE-SU-2013:0506) を追加ベンダ情報：openSUSE (openSUSE-SU-2013:0494) を追加ベンダ情報：Debian (DSA-2644) を追加 [2013年08月05日] CVSS による深刻度：内容を更新	Feb. 17, 2018, 10:37 a.m.