CVE-2017-11410

Published Jul 18, 2017

Last updated a year ago

Overview

Description: In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding validation of the relationships between indexes and lengths. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-7702.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 3.0

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

CVSS 2.0

Type: Primary
Base score: 7.8
Impact score: 6.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:N/I:N/A:C

Weaknesses

nvd@nist.gov: CWE-20

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "80E2A443-32DB-4C8B-8D2D-AE4F80A154A1"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2EF0B55F-A412-48E2-9047-7CCA8442766D"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C45C7F24-9B97-4FF6-AFE8-102EDA0B26D2"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D8BE013B-8615-49DB-939E-B7E289171467"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FDB30F17-A41A-4F09-977F-AB91E509247E"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.5:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D900BA83-D5D3-4A8D-8C32-D135A3E5190E"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.6:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A630396B-1D60-4C45-9A45-F15E542B1C1C"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.7:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F9A6D9AC-17D2-4A8F-A32A-23E8854D5514"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.8:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "03EF9BF7-868D-4E3C-978D-B3B5241011B2"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.9:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B0F77523-59BD-431A-A790-C3886D337EEA"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.10:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "99405746-65A3-4D33-8B03-B7091C3B8E29"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.11:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FD2B0D12-04C7-4CBF-AF70-EE3EF37BA6FC"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.12:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "04A8464D-85E7-4FDE-B922-A542451B18FF"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.0.13:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6FE77814-337C-4BA9-861B-4EDAFE49A43F"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "32F65580-D1F4-4ABC-A358-545BF29D8089"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.2.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E6568A81-BE0B-4AEF-808C-74CD0C2EE9FD"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.2.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DFFBDC3C-3701-4890-8AA5-AD96EB528F05"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.2.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AB13134E-A2E8-46A5-88B2-E2C2C24B6780"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.2.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7FC9883C-4B22-4C81-8C51-932BBF2CB3B8"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.2.5:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9F0E7715-61FE-404D-834F-3EFC75423292"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.2.6:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EDFF360E-2CE4-4722-83E6-08B811852422"
          },
          {
            "criteria": "cpe:2.3:a:wireshark:wireshark:2.2.7:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E3B1F0CD-ACD8-4583-AEF6-6EEEFBE397C7"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.0

CVSS 2.0

Weaknesses

Social media

Configurations

References