CVE-2013-7112: Input Validation
The dissectsipcommon function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 does not check for empty lines, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7112?
CVE-2013-7112 is classified as a denial of service vulnerability due to an infinite loop in the SIP dissector.
How do I fix CVE-2013-7112?
To fix CVE-2013-7112, you should upgrade Wireshark to version 1.8.12 or later, or 1.10.4 or later.
What versions of Wireshark are affected by CVE-2013-7112?
CVE-2013-7112 affects Wireshark versions 1.8.0 through 1.8.11 and versions 1.10.0 through 1.10.3.
What type of attack does CVE-2013-7112 enable?
CVE-2013-7112 enables a denial of service attack that can be triggered by sending crafted SIP packets.
Is there a workaround for CVE-2013-7112?
There is no known workaround for CVE-2013-7112; upgrading to the patched versions is recommended.