Vulnerability Name:

CVE-2017-17085

Assigned:2017-12-01
Published:2017-11-30
Updated:2017-12-15
Summary:In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was addressed in epan/dissectors/packet-cipsafety.c by validating the packet length.
CVSS v3 Severity:7.5 High (CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
5.3 Medium (CCN CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
4.6 Medium (CCN Temporal CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-754
References:Source: BID
Type: VENDOR_ADVISORY
102071

Source: CONFIRM
Type: VENDOR_ADVISORY
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14250

Source: CONFIRM
Type: VENDOR_ADVISORY
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f5939debe96e3c3953c6020818f1fbb80eb83ce8

Source: XF
Type: UNKNOWN
wireshark-cve201717085-dos(135752)

Source: DEBIAN
Type: VENDOR_ADVISORY
DSA-4060

Source: CONFIRM
Type: VENDOR_ADVISORY
https://www.wireshark.org/security/wnpa-sec-2017-49.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:wireshark:wireshark:2.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:wireshark:wireshark:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:wireshark:wireshark:2.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:wireshark:wireshark:2.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:wireshark:wireshark:2.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:wireshark:wireshark:2.2.5:*:*:*:*:*:*:*
  • OR cpe:/a:wireshark:wireshark:2.2.6:*:*:*:*:*:*:*
  • OR cpe:/a:wireshark:wireshark:2.2.7:*:*:*:*:*:*:*
  • OR cpe:/a:wireshark:wireshark:2.2.8:*:*:*:*:*:*:*
  • OR cpe:/a:wireshark:wireshark:2.2.9:*:*:*:*:*:*:*
  • OR cpe:/a:wireshark:wireshark:2.2.10:*:*:*:*:*:*:*
  • OR cpe:/a:wireshark:wireshark:2.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:wireshark:wireshark:2.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:wireshark:wireshark:2.4.2:*:*:*:*:*:*:*

  • Configuration 2:
  • cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:wireshark:wireshark:2.2.0:*:*:*:*:*:*:*

  • Configuration CCN 2:
  • cpe:/a:wireshark:wireshark:2.4.0:*:*:*:*:*:*:*

  • Configuration CCN 3:
  • cpe:/a:wireshark:wireshark:2.4.2:*:*:*:*:*:*:*

  • Configuration CCN 4:
  • cpe:/a:wireshark:wireshark:2.2.10:*:*:*:*:*:*:*

  • Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:201717085
    V
    CVE-2017-17085
    2017-12-15
    oval:com.ubuntu.xenial:def:201717085000
    V
    CVE-2017-17085 on Ubuntu 16.04 LTS (xenial) - untriaged.
    2017-12-01
    oval:com.ubuntu.trusty:def:201717085000
    V
    CVE-2017-17085 on Ubuntu 14.04 LTS (trusty) - untriaged.
    2017-12-01
    BACK
    wireshark wireshark 2.2.0
    wireshark wireshark 2.2.1
    wireshark wireshark 2.2.2
    wireshark wireshark 2.2.3
    wireshark wireshark 2.2.4
    wireshark wireshark 2.2.5
    wireshark wireshark 2.2.6
    wireshark wireshark 2.2.7
    wireshark wireshark 2.2.8
    wireshark wireshark 2.2.9
    wireshark wireshark 2.2.10
    wireshark wireshark 2.4.0
    wireshark wireshark 2.4.1
    wireshark wireshark 2.4.2
    debian debian_linux 8.0
    debian debian_linux 9.0