CVE-2010-3445

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-11-26 · updated 2026-06-16
Weakness: CWE-399

Description

Stack consumption vulnerability in the dissect_ber_unknown function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark 1.4.x before 1.4.1 and 1.2.x before 1.2.12 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a long string in an unknown ASN.1/BER encoded packet, as demonstrated using SNMP.

Affected products

Wireshark Foundation Wireshark: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5 (+7)

References

http://archives.neohapsis.com/archives/bugtraq/2010-09/0088.html
http://blogs.sun.com/security/entry/resource_management_errors_vulnerability_in
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055364.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055650.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055664.html
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
http://secunia.com/advisories/42392
http://secunia.com/advisories/42411
http://secunia.com/advisories/42877
http://secunia.com/advisories/43068
http://secunia.com/advisories/43759

Get alerted when CVE-2010-3445 or the next vulnerability affects your stack