CVE-2018-14438: Input Validation
Published Jul 20, 2018
·Updated
In Wireshark through 2.6.2, the createapprunningmutex function in wsutil/fileutil.c calls SetSecurityDescriptorDacl to set a NULL DACL, which allows attackers to modify the access control arbitrarily.
Affected Software
1 affected component
Wireshark Wireshark<=2.6.2
Event History
Jul 20, 2018
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-14438?
CVE-2018-14438 is considered to have a high severity due to its potential for unauthorized access control modifications.
2
How do I fix CVE-2018-14438?
To fix CVE-2018-14438, you should update Wireshark to a version later than 2.6.2 that addresses this vulnerability.
3
What does CVE-2018-14438 affect?
CVE-2018-14438 affects Wireshark versions up to and including 2.6.2.
4
What are the risks associated with CVE-2018-14438?
The risks related to CVE-2018-14438 include the potential for attackers to arbitrarily modify access controls.
5
Is CVE-2018-14438 related to any specific function in Wireshark?
Yes, CVE-2018-14438 is related to the create_app_running_mutex function in the wsutil/file_util.c file.