CVE-2020-7045 - wireshark: invalid memory access in BT ATT dissector

MEDIUM

wireshark: invalid memory access in BT ATT dissector

Published Jan 16, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 1.46%

In Wireshark 3.0.x before 3.0.8, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by validating opcodes.

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	wireshark	Out of support scope	n/a
Red Hat Enterprise Linux 6	wireshark	Out of support scope	n/a
Red Hat Enterprise Linux 7	wireshark	Not affected	n/a
Red Hat Enterprise Linux 8	wireshark	Will not fix	n/a

Red Hat statement

This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 7 as they did not include the vulnerable code.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-476

NULL Pointer Dereference

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2020-7045		Vendor Advisory
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16258		x_refsource_MISCExploitIssue TrackingPatchVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1798671		Issue Tracking
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=01f261de41f4dd3233ef578e5c0ffb9c25c7d14d		x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7045
https://www.cve.org/CVERecord?id=CVE-2020-7045
https://www.wireshark.org/security/wnpa-sec-2020-02.html		x_refsource_MISCVendor Advisory