alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-1119
Matching passage: CVE-2015-1119. CWE: UNKNOWN. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4.
Near-miss passage: CVE-2015-4831. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2015-4822.
Query: rule covering Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)
Matching passage: Sigma rule: Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j). Logsource: windows / process_creation. Rule: title: Suspicious Processes Spawned by Java.EXE id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d related: - id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0 type: similar status: test description: Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j) references: - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/ author: Andreas Hunkeler (@Karneades), Florian Roth date: 2021-12-17 modified: 2024-01-18 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \java.exe Image|endswith: - \AppVLP.exe - \bitsadmin.exe - \certutil.exe - \cscript.exe - \curl.exe - \forfiles.exe - \hh.exe - \mftrace.exe - \mshta.exe - \net.exe - \net1.exe - \query.exe - \reg.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \scrcons.exe - \scriptrunner.exe - \sh.exe - \systeminfo.exe - \whoami.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Legitimate calls to system binaries - Company specific internal usage level: high
Near-miss passage: Sigma rule: Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved o. Logsource: windows / process_creation. Rule: title: Potential SysInternals ProcDump Evasion id: 79b06761-465f-4f88-9ef2-150e24d3d737 status: test description: Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name references: - https://twitter.com/mrd0x/status/1480785527901204481 author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2023-05-09 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: - copy procdump - move procdump selection_2: CommandLine|contains|all: - 'copy ' - '.dmp ' CommandLine|contains: - 2.dmp - lsass - out.dmp selection_3: CommandLine|contains: - copy lsass.exe_ - move lsass.exe_ condition: 1 of selection_* falsepositives: - False positives are expected in cases in which ProcDump just gets copied to a different directory without any renaming level: high
Query: vulnerability: Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) 
Matching passage: CVE-2015-3076. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9161, CVE-2015-3046, CVE-2015-3049, CVE-2015-3050, CVE-2015-3051, CVE-2015-3052, CVE-2015-3056, CVE-2015-3057, and CVE-2015-3070.
Near-miss passage: CVE-2015-9028. CWE: CWE-119. CVSS: 7.800000190734863. In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a cryptographic routine.
Query: secure coding against Improper Check for Dropped Privileges
Matching passage: CWE-273 Improper Check for Dropped Privileges. The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
Near-miss passage: CWE-466 Return of Pointer Value Outside of Expected Range. A function can return a pointer to memory that is outside of the buffer that the pointer is expected to reference.
Query: exploit The Internet Access Point Protocol (IAPP) module on Cisco Wireless LAN Controller (WLC) devices with software 8.1(104.37) allows remote attackers to trigger incorrect traffic forwa
Matching passage: CVE-2015-6258. CWE: CWE-20. CVSS: 5.0. The Internet Access Point Protocol (IAPP) module on Cisco Wireless LAN Controller (WLC) devices with software 8.1(104.37) allows remote attackers to trigger incorrect traffic forwarding via crafted IPv6 packets, aka Bug ID CSCuv40033.
Near-miss passage: CVE-2015-4035. CWE: CWE-20. CVSS: 7.800000190734863. scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name.
Query: CVE similar to CVE-2015-8996
Matching passage: CVE-2015-8996. CWE: CWE-362. CVSS: 7.0. In TrustZone a time-of-check time-of-use race condition could potentially exist in a QFPROM routine in all Android releases from CAF using the Linux kernel.
Near-miss passage: CVE-2015-5232. CWE: CWE-362. CVSS: 8.100000381469727. Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.
Query: describe CVE-2015-7629
Matching passage: CVE-2015-7629. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a TextFormat object with a crafted tabStops property, a different vulnerability than CVE-2015-7631, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-5461. CWE: UNKNOWN. CVSS: 6.400000095367432. Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Query: patch priority for CVE-2015-1957
Matching passage: CVE-2015-1957. CWE: CWE-200. CVSS: 5.300000190734863. IBM WebSphere MQ 7.5.x before 7.5.0.6 and 8.0.x before 8.0.0.3 allows remote authenticated users to obtain sensitive information via a man-in-the-middle attack, related to duplication of message data in cleartext outside the protected payload. IBM X-Force ID: 103482.
Near-miss passage: CVE-2015-5383. CWE: CWE-200. CVSS: 7.5. Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
Query: Sigma rule for Detects a suspicious printer driver installation with an empty Manufacturer value
Matching passage: Sigma rule: Detects a suspicious printer driver installation with an empty Manufacturer value. Logsource: windows / registry_set. Rule: title: Suspicious Printer Driver Empty Manufacturer id: e0813366-0407-449a-9869-a2db1119dc41 status: test description: Detects a suspicious printer driver installation with an empty Manufacturer value references: - https://twitter.com/SBousseaden/status/1410545674773467140 author: Florian Roth (Nextron Systems) date: 2020-07-01 modified: 2023-08-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574 - cve.2021-1675 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \Control\Print\Environments\Windows x64\Drivers - \Manufacturer Details: (Empty) filter_cutepdf: TargetObject|contains: \CutePDF Writer v4.0\ filter_vnc: TargetObject|contains: - \VNC Printer (PS)\ - \VNC Printer (UD)\ filter_pdf24: TargetObject|contains: \Version-3\PDF24\ condition: selection and not 1 of filter_* falsepositives: - Alerts on legitimate printer drivers that do not set any more details in the Manufacturer value level: high
Near-miss passage: Sigma rule: Detects volume shadow copy mount via Windows event log. Logsource: windows / system. Rule: title: Volume Shadow Copy Mount id: f512acbf-e662-4903-843e-97ce4652b740 status: test description: Detects volume shadow copy mount via Windows event log references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) date: 2020-10-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1003.002 logsource: product: windows service: system detection: selection: Provider_Name: Microsoft-Windows-Ntfs EventID: 98 DeviceName|contains: HarddiskVolumeShadowCopy condition: selection falsepositives: - Legitimate use of volume shadow copy mounts (backups maybe). level: low
Query: describe CVE-2015-2275
Matching passage: CVE-2015-2275. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to inject arbitrary web script or HTML via the parameters[data][7][title] parameter in a saveImageData action to index.php/AJAXProxy.
Near-miss passage: CVE-2015-2665. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explore. Logsource: windows / security. Rule: title: Windows Network Access Suspicious desktop.ini Action id: 35bc7e28-ee6b-492f-ab04-da58fcf6402e status: test description: Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk. references: - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/ author: Tim Shelton (HAWK.IO) date: 2021-12-06 modified: 2022-01-16 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.009 logsource: product: windows service: security detection: selection: EventID: 5145 ObjectType: File RelativeTargetName|endswith: \desktop.ini AccessList|contains: - WriteData - DELETE - WriteDAC - AppendData - AddSubdirectory condition: selection falsepositives: - Read only access list authority level: medium
Near-miss passage: Sigma rule: Detects suspicious processes including shells spawnd from WinRM host process. Logsource: windows / process_creation. Rule: title: Suspicious Processes Spawned by WinRM id: 5cc2cda8-f261-4d88-a2de-e9e193c86716 status: test description: Detects suspicious processes including shells spawnd from WinRM host process author: Andreas Hunkeler (@Karneades), Markus Neis references: - Internal Research date: 2021-05-20 modified: 2022-07-14 tags: - attack.t1190 - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \wsmprovhost.exe Image|endswith: - \cmd.exe - \sh.exe - \bash.exe - \powershell.exe - \pwsh.exe - \wsl.exe - \schtasks.exe - \certutil.exe - \whoami.exe - \bitsadmin.exe condition: selection falsepositives: - Legitimate WinRM usage level: high
Query: vulnerability: Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 bef
Matching passage: CVE-2015-8800. CWE: CWE-74. CVSS: 7.300000190734863. Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allow remote authenticated users to conduct argument-injection attacks by leveraging certain named-pipe access.
Near-miss passage: CVE-2015-7544. CWE: CWE-74. CVSS: 9.100000381469727. redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment.
Query: detection rule: Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS e
Matching passage: Sigma rule: Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS e. Logsource: aws / cloudtrail. Rule: title: AWS IAM Backdoor Users Keys id: 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2 status: test description: 'Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org. ' references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py author: faloker date: 2020-02-12 modified: 2022-10-09 tags: - attack.persistence - attack.privilege-escalation - attack.t1098 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: iam.amazonaws.com eventName: CreateAccessKey filter: userIdentity.arn|contains: responseElements.accessKey.userName condition: selection_source and not filter falsepositives: - Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming) - AWS API keys legitimate exchange workflows level: medium
Near-miss passage: Sigma rule: Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer). Logsource: windows / process_creation. Rule: title: Uncommon Child Processes Of SndVol.exe id: ba42babc-0666-4393-a4f7-ceaf5a69191e status: test description: Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer) references: - https://twitter.com/Max_Mal_/status/1661322732456353792 author: X__Junior (Nextron Systems) date: 2023-06-09 tags: - attack.execution logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: \SndVol.exe filter_main_rundll32: Image|endswith: \rundll32.exe CommandLine|contains: ' shell32.dll,Control_RunDLL ' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-0068
Matching passage: CVE-2015-0068. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0039, and CVE-2015-0052.
Near-miss passage: CVE-2015-1943. CWE: CWE-399. CVSS: 7.800000190734863. IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.
Query: Sigma rule for Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.
Matching passage: Sigma rule: Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.. Logsource: windows / registry_set. Rule: title: Potential SentinelOne Shell Context Menu Scan Command Tampering id: 6c304b02-06e6-402d-8be4-d5833cdf8198 status: test description: Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne. references: - https://mrd0x.com/sentinelone-persistence-via-menu-context/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-06 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \shell\SentinelOneScan\command\ filter_main_sentinelone_default_scan_binary: Details|startswith: - C:\Program Files\SentinelOne\Sentinel Agent - C:\Program Files (x86)\SentinelOne\Sentinel Agent Details|contains: \SentinelScanFromContextMenu.exe filter_main_sentinelone_binary: Image|endswith: - C:\Program Files\SentinelOne\ - C:\Program Files (x86)\SentinelOne\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.. Logsource: opencanary / application. Rule: title: OpenCanary - MSSQL Login Attempt Via Windows Authentication id: 6e78f90f-0043-4a01-ac41-f97681613a66 status: test description: 'Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 9002 condition: selection falsepositives: - Unlikely level: high
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / file_event. Rule: title: GoToAssist Temporary Installation Artefact id: 5d756aee-ad3e-4306-ad95-cb1abec48de2 status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows author: frack113 date: 2022-02-13 tags: - attack.command-and-control - attack.t1219.002 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: \AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Expert\ condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Use of the commandline to shutdown or reboot windows. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Shutdown id: 34ebb878-1b15-4895-b352-ca2eeb99b274 status: test description: Use of the commandline to shutdown or reboot windows references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown author: frack113 date: 2022-01-01 tags: - attack.impact - attack.t1529 logsource: category: process_creation product: windows detection: selection: Image|endswith: \shutdown.exe CommandLine|contains: - '/r ' - '/s ' condition: selection falsepositives: - Unknown level: medium
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD
Matching passage: CVE-2015-9165. CWE: CWE-415. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, incorrect error handling could lead to a double free in QTEE file service API.
Near-miss passage: CVE-2015-1239. CWE: CWE-415. CVSS: 6.5. Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.
Query: detect Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. T in logs
Matching passage: Sigma rule: Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. T. Logsource: windows / ps_classic_start. Rule: title: PowerShell Download Via Net.WebClient - PowerShell Classic id: 3236fcd0-b7e3-4433-b4f8-86ad61a9af2d related: - id: 65531a81-a694-4e31-ae04-f8ba5bc33759 type: derived status: test description: 'Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. This technique is often abused by attackers to download additional payloads. ' references: - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html author: Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2026-04-28 tags: - attack.execution - attack.command-and-control - attack.t1059.001 - attack.t1105 logsource: product: windows category: ps_classic_start detection: selection_webclient: Data|contains: Net.WebClient selection_download: Data|contains: - .DownloadFile( - .DownloadString( condition: all of selection_* falsepositives: - This activity may be used by legitimate software, such as patch management tools or software updaters. Investigate any such activity and apply the necessary filter. level: low
Near-miss passage: Sigma rule: Detects SILENTTRINITY stager dll loading activity. Logsource: windows / image_load. Rule: title: HackTool - SILENTTRINITY Stager DLL Load id: 75c505b1-711d-4f68-a357-8c3fe37dbf2d related: - id: 03552375-cc2c-4883-bbe4-7958d5a980be type: derived status: test description: Detects SILENTTRINITY stager dll loading activity references: - https://github.com/byt3bl33d3r/SILENTTRINITY author: Aleksey Potapov, oscd.community date: 2019-10-22 modified: 2023-02-17 tags: - attack.command-and-control - attack.t1071 logsource: category: image_load product: windows detection: selection: Description|contains: st2stager condition: selection falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-8734
Matching passage: CVE-2015-8734. CWE: CWE-20. CVSS: 5.5. The dissect_nwp function in epan/dissectors/packet-nwp.c in the NWP dissector in Wireshark 2.0.x before 2.0.1 mishandles the packet type, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-8741. CWE: CWE-20. CVSS: 5.5. The dissect_ppi function in epan/dissectors/packet-ppi.c in the PPI dissector in Wireshark 2.0.x before 2.0.1 does not initialize a packet-header data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.