#VU41947 Buffer overflow in Wireshark - CVE-2014-2299

Vulnerability identifier: #VU41947

Vulnerability risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2014-2299

CWE-ID: CWE-119

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Wireshark
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Wireshark.org

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.8.0 - 1.8.12, 1.10.0 - 1.10.5

---

External links
https://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html
https://lists.opensuse.org/opensuse-updates/2014-03/msg00047.html
https://osvdb.org/show/osvdb/104199
https://packetstormsecurity.com/files/126337/Wireshark-1.8.12-1.10.5-wiretap-mpeg.c-Stack-Buffer-Overflow.html
https://rhn.redhat.com/errata/RHSA-2014-0341.html
https://rhn.redhat.com/errata/RHSA-2014-0342.html
https://secunia.com/advisories/57480
https://secunia.com/advisories/57489
https://www.debian.org/security/2014/dsa-2871
https://www.exploit-db.com/exploits/33069
https://www.securityfocus.com/bid/66066
https://www.securitytracker.com/id/1029907
https://www.wireshark.org/security/wnpa-sec-2014-04.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9843
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f567435ac7140c96a5de56dbce3d5e7659af4d09

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.