CVE-2014-6432: Medium severity wireshark vulnerability

Published Sep 20, 2014

Updated

The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not prevent data overwrites during copy operations, which allows remote attackers to cause a denial of service (application crash) via a crafted file.

Affected Software

11 affected components

Wireshark Wireshark=1.10.0

Wireshark Wireshark=1.10.1

Wireshark Wireshark=1.10.2

Wireshark Wireshark=1.10.3

Wireshark Wireshark=1.10.4

Wireshark Wireshark=1.10.5

Wireshark Wireshark=1.10.6

Wireshark Wireshark=1.10.7

Wireshark Wireshark=1.10.8

Wireshark Wireshark=1.10.9

Wireshark Wireshark=1.12.0

Remediation

Patch Available

https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=47c592938ba9f0caeacc4c2ccadb370e72f293a2

Event History

Sep 20, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-6432?

CVE-2014-6432 has a medium severity rating due to its potential to cause denial of service.

How do I fix CVE-2014-6432?

To fix CVE-2014-6432, update Wireshark to version 1.10.10 or later, or to version 1.12.1 or later.

Which versions of Wireshark are affected by CVE-2014-6432?

CVE-2014-6432 affects Wireshark versions 1.10.0 through 1.10.9 and 1.12.0.

What type of vulnerability is CVE-2014-6432?

CVE-2014-6432 is a vulnerability that allows remote attackers to cause a denial of service via crafted files.

Is CVE-2014-6432 easily exploitable?

Yes, an attacker can exploit CVE-2014-6432 by sending a specially crafted file to the affected Wireshark versions.