CVE-2014-4174: Buffer Overflow
First published: Wed Jun 18 2014(Updated: )
wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted packet-trace file that includes a large packet.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wireshark | =1.10.0 | |
| Wireshark | =1.10.1 | |
| Wireshark | =1.10.2 | |
| Wireshark | =1.10.3 |
Remedy
http://anonsvn.wireshark.org/viewvc/trunk-1.10/wiretap/libpcap.c?r1=53123&r2=53122&pathrev=53123
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://anonsvn.wireshark.org/viewvc/trunk-1.10/wiretap/libpcap.c?r1=53123&r2=53122&pathrev=53123
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=53123
- http://www.wireshark.org/security/wnpa-sec-2014-05.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8808
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9390
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9753
Frequently Asked Questions
What is the severity of CVE-2014-4174?
CVE-2014-4174 is considered critical as it allows remote attackers to execute arbitrary code or cause a denial of service.
How do I fix CVE-2014-4174?
To fix CVE-2014-4174, upgrade Wireshark to version 1.10.4 or later.
What versions of Wireshark are affected by CVE-2014-4174?
Wireshark versions 1.10.0 through 1.10.3 are affected by CVE-2014-4174.
What type of attacks can CVE-2014-4174 enable?
CVE-2014-4174 can enable remote code execution and memory corruption attacks.
Is there a workaround for CVE-2014-4174?
There are no known workarounds for CVE-2014-4174; upgrading Wireshark is the recommended action.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/remedy
- agent/severity
- agent/weakness
- agent/description
- agent/tags
- agent/softwarecombine
- agent/event
- vendor/wireshark
- canonical/wireshark
- version/wireshark/1.10.0
- version/wireshark/1.10.1
- version/wireshark/1.10.2
- version/wireshark/1.10.3