Описание
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
A flaw was found in Wireshark. A use-after-free vulnerability exists in the CMS (Cryptographic Message Syntax) protocol dissector. An attacker could exploit this by crafting a malicious network packet, leading to a crash and a denial of service (DoS) for the application.
Отчет
This vulnerability is rated Moderate because exploitation requires user interaction (opening a crafted capture file or inspecting malicious traffic) and results only in an application crash. Since Wireshark is an interactive diagnostic tool rather than a continuous privileged daemon, the impact is strictly confined to a local denial of service for the active session, with no risk of privilege escalation or system compromise.
Меры по смягчению последствий
To mitigate this do not open untrusted packet captures in Wireshark/tshark, and avoid exposing dissectors to untrusted LDAP/CMS traffic on the wire. Prefer analyzing captures in an isolated session or sandbox rather than on production hosts
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | wireshark | Fix deferred | ||
| Red Hat Enterprise Linux 6 | wireshark | Not affected | ||
| Red Hat Enterprise Linux 7 | wireshark | Not affected | ||
| Red Hat Enterprise Linux 8 | wireshark | Not affected | ||
| Red Hat Enterprise Linux 9 | wireshark | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 all ...
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Уязвимость анализатора протокола CMS анализатора трафика компьютерных сетей Wireshark, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
5.5 Medium
CVSS3