Vulnerability CVE-2013-7112: Information

Description

The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 does not check for empty lines, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

Severity: MEDIUM (5.0)

URL: https://nvd.nist.gov/vuln/detail/CVE-2013-7112
Published: Dec. 20, 2013
Modified: April 19, 2014
Error type identifier: CWE-20

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
wiresharksisyphus1.10.5-alt14.2.5-alt2ALT-PU-2014-1220-1114785Fixed
wiresharkp101.10.5-alt14.0.11-alt1ALT-PU-2014-1220-1114785Fixed
wiresharkp91.10.5-alt14.0.8-alt1ALT-PU-2014-1220-1114785Fixed
wiresharkc10f11.10.5-alt14.0.11-alt1ALT-PU-2014-1220-1114785Fixed
wiresharkc9f21.10.5-alt14.0.11-alt1ALT-PU-2014-1220-1114785Fixed
wiresharkc72.2.7-alt1.M70C.12.2.7-alt1.M70C.1ALT-PU-2017-1698-1183820Fixed
wiresharkp111.10.5-alt14.2.5-alt2ALT-PU-2014-1220-1114785Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-sip.c?r1=51738&r2=51737&pathrev=51738
  • Patch
http://www.wireshark.org/security/wnpa-sec-2013-66.html
  • Vendor Advisory
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9388
  • Exploit
http://anonsvn.wireshark.org/viewvc?view=revision&revision=51738
  • Patch
openSUSE-SU-2014:0020
    openSUSE-SU-2014:0013
      openSUSE-SU-2014:0017
        56285
          56313
            MDVSA-2013:296
              RHSA-2014:0342
                RHSA-2014:0341

                    1. Configuration 1

                      cpe:2.3:a:wireshark:wireshark:1.8.10:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.8.6:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.8.2:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.8.9:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.8.11:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.8.3:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.10.0:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.10.3:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.8.1:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.10.2:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.10.1:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.8.7:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.8.0:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.8.4:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.8.5:*:*:*:*:*:*:*
                      cpe:2.3:a:wireshark:wireshark:1.8.8:*:*:*:*:*:*:*
                  VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
                  Version: v24.5.3
                  Back to top