Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Wireshark ASN.1 BER Dissector Crashes with Malicious Packet

CVE-2014-5165 · published 12 years ago
Summary

A security issue in Wireshark's ASN.1 BER dissector can cause the program to crash if it receives a specially crafted packet. This could potentially be used by an attacker to disrupt Wireshark's operation. To fix this issue, update to Wireshark 1.10.9 or later.

What to do
  • Update debian wireshark to version 1.12.0+git+4fab41a1-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian wireshark < 1.12.0+git+4fab41a1-1
Fix: upgrade to 1.12.0+git+4fab41a1-1
Debian:12 debian wireshark < 1.12.0+git+4fab41a1-1
Fix: upgrade to 1.12.0+git+4fab41a1-1
Debian:13 debian wireshark < 1.12.0+git+4fab41a1-1
Fix: upgrade to 1.12.0+git+4fab41a1-1
Debian:14 debian wireshark < 1.12.0+git+4fab41a1-1
Fix: upgrade to 1.12.0+git+4fab41a1-1
– wireshark wireshark 1.10.0
1.10.1
1.10.2
1.10.3
1.10.4
1.10.5
1.10.6
1.10.7
1.10.8
cpe:2.3:a:wireshark:wireshark:1.10.0:*:*:*:*:*:*:*
Original advisory text
The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.10.x before 1.10.9 does not properly validate padding values, which allows r...
The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.10.x before 1.10.9 does not properly validate padding values, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet.
References
Severity
5.0 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published1 Aug 2014
Updated30 Oct 2026
First seen8 Aug 2026
Sources
DEBIAN-CVE-2014-5165 · OSV
CVE-2014-5165 · NVD
Track software like this
Free during beta