CVE-2010-0304 in the critical feed json
Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause…
published 16y ago modified 4mo ago also EUVD-2010-0335
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 74.1%
- EPSS 74.1% chance of exploitation in 30 days, percentile 99.4%
- public exploits
- 5
- Metasploit and Exploit-DB
Summary
Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.
Patch / fix
- wireshark Debian 14, Debian 13, Debian 12 1.2.6-1
debian advisories DEBIAN-CVE-2010-0304
- wireshark RHEL 3 1.0.11-EL3.6
- wireshark RHEL 4 1.0.11-1.el4_8.5
- wireshark RHEL 5 1.0.11-1.el5_5.5
- wireshark-gnome RHEL 3 1.0.11-EL3.6
- wireshark-gnome RHEL 4 1.0.11-1.el4_8.5
- wireshark-gnome RHEL 5 1.0.11-1.el5_5.5
red hat advisories RHSA-2010:0360
Is CVE-2010-0304 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2010-0304 updated cvss 2.9
wireshark: crash in LWRES dissector
-
Red Hat Desktop version 3 wireshark 1.0.11-EL3.6, wireshark-gnome 1.0.11-EL3.6 Red Hat Enterprise Linux (v. 5 server) wireshark 1.0.11-1.el5_5.5, wireshark-gnome 1.0.11-1.el5_5.5 Red Hat Enterprise Linux AS version 3 wireshark 1.0.11-EL3.6, wireshark-gnome 1.0.11-EL3.6 Red Hat Enterprise Linux AS version 4 wireshark 1.0.11-1.el4_8.5, wireshark-gnome 1.0.11-1.el4_8.5 Red Hat Enterprise Linux Desktop (v. 5 client) wireshark 1.0.11-1.el5_5.5, wireshark-gnome 1.0.11-1.el5_5.5 Red Hat Enterprise Linux Desktop version 4 wireshark 1.0.11-1.el4_8.5, wireshark-gnome 1.0.11-1.el4_8.5fixed: vendor fix RHSA-2010:0360
+5 more productsfewer
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) wireshark 1.0.11-1.el5_5.5, wireshark-gnome 1.0.11-1.el5_5.5 Red Hat Enterprise Linux ES version 3 wireshark 1.0.11-EL3.6, wireshark-gnome 1.0.11-EL3.6 Red Hat Enterprise Linux ES version 4 wireshark 1.0.11-1.el4_8.5, wireshark-gnome 1.0.11-1.el4_8.5 Red Hat Enterprise Linux WS version 3 wireshark 1.0.11-EL3.6, wireshark-gnome 1.0.11-EL3.6 Red Hat Enterprise Linux WS version 4 wireshark 1.0.11-1.el4_8.5, wireshark-gnome 1.0.11-1.el4_8.5
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (Metasploit exploit/multi/misc/wireshark_lwres_getaddrbyname)
- Published
Exploit prediction
74.08% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/multi/misc/wireshark_lwres_getaddrbyname Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow metasploit exploit, great rank, 2010-01-27
- Metasploit exploit/multi/misc/wireshark_lwres_getaddrbyname_loop Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow (loop) metasploit exploit, great rank, 2010-01-27
- EDB-16292 Wireshark - LWRES Dissector getaddrsbyname_request Buffer Overflow (Loop) (Metasploit) remote, 2010-11-24
- EDB-16289 Wireshark - LWRES Dissector getaddrsbyname_request Buffer Overflow (Metasploit) remote, 2010-02-11
- EDB-11288 Wireshark 1.2.5 - 'LWRES getaddrbyname' Stack Buffer Overflow (PoC) dos, 2010-01-29
- securityfocus.com http://www.securityfocus.com/bid/37985 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
vupen.com
/english/advisories/2010/0239
vdb-entry, patch, vendor-advisory
-
securityfocus.com
/bid/37985
vdb-entry, exploit
-
debian.org
/security/2010/dsa-1983
vendor-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2010:031
vendor-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2010-March/036415.html
vendor-advisory
-
wireshark.org
/security/wnpa-sec-2010-02.html
vendor-advisory
-
secunia.com
/advisories/38348
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/38257
third-party-advisory, vendor-advisory
-
openwall.com
/lists/oss-security/2010/01/29/4
mailing-list
- metasploit.com /modules/exploit/multi/misc/wireshark_lwres_getaddrbyname
-
secunia.com
/advisories/38829
third-party-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9933
vdb-entry, signature
-
osvdb.org
/61987
vdb-entry
- anonsvn.wireshark.org /viewvc/trunk-1.2/epan/dissectors/packet-lwres.c?view=diff&r1=31596&r2=28492&diff_format=h
-
securitytracker.com
/id?1023516
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/55951
vdb-entry
- wireshark.org /security/wnpa-sec-2010-01.html
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8490
vdb-entry, signature
Sources
- CVE List CVE-2010-0304
- NVD CVE-2010-0304
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.