Возможность зацикливания диссектора протокола BGP в Wireshark из-за недостаточной валидации длины атрибутов пути
Описание
В Wireshark была обнаружена уязвимость в диссекторе протокола BGP, которая может привести к зацикливанию процесса (large loop). Проблема возникала из-за недостаточной валидации длины атрибутов пути в файле epan/dissectors/packet-bgp.c.
Затронутые версии ПО
- Wireshark 2.6.0 до 2.6.1
- Wireshark 2.4.0 до 2.4.7
- Wireshark 2.2.0 до 2.2.15
Тип уязвимости
Зацикливание процесса (large loop)
Ссылки
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Issue TrackingVendor Advisory
- Mailing ListThird Party Advisory
- Vendor Advisory
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Issue TrackingVendor Advisory
- Mailing ListThird Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
7.5 High
CVSS3
7.8 High
CVSS2
Дефекты
Связанные уязвимости
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the BGP protocol dissector could go into a large loop. This was addressed in epan/dissectors/packet-bgp.c by validating Path Attribute lengths.
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the BGP protocol dissector could go into a large loop. This was addressed in epan/dissectors/packet-bgp.c by validating Path Attribute lengths.
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ...
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the BGP protocol dissector could go into a large loop. This was addressed in epan/dissectors/packet-bgp.c by validating Path Attribute lengths.
EPSS
7.5 High
CVSS3
7.8 High
CVSS2