Multiple vulnerabilities in Wireshark

1) Input validation error

EUVDB-ID: #VU45259

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2011-1143

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (NULL pointer dereference and application crash) via a crafted .pcap file.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 0.99.2 - 1.4.2

CPE2.3

External links

https://anonsvn.wireshark.org/viewvc?view=rev&revision=34018
https://lists.fedoraproject.org/pipermail/package-announce/2011-March/055364.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-March/055650.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-March/055664.html
https://secunia.com/advisories/43759
https://secunia.com/advisories/43821
https://secunia.com/advisories/44169
https://secunia.com/advisories/48947
https://www.kb.cert.org/vuls/id/215900
https://www.redhat.com/support/errata/RHSA-2011-0370.html
https://www.securityfocus.com/bid/46796
https://www.securitytracker.com/id?1025148
https://www.vupen.com/english/advisories/2011/0626
https://www.vupen.com/english/advisories/2011/0719
https://www.wireshark.org/docs/relnotes/wireshark-1.4.4.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5157
https://hermes.opensuse.org/messages/8086844
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16209

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Buffer overflow

EUVDB-ID: #VU45459

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-0444

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Buffer overflow in the MAC-LTE dissector (epan/dissectors/packet-mac-lte.c) in Wireshark 1.2.0 through 1.2.13 and 1.4.0 through 1.4.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of RARs.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.2 - 1.4.2

CPE2.3

External links

https://lists.fedoraproject.org/pipermail/package-announce/2011-February/053650.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-February/053669.html
https://osvdb.org/70403
https://secunia.com/advisories/43175
https://www.mandriva.com/security/advisories?name=MDVSA-2011:007
https://www.redhat.com/support/errata/RHSA-2011-0369.html
https://www.securityfocus.com/bid/45775
https://www.vupen.com/english/advisories/2011/0079
https://www.vupen.com/english/advisories/2011/0104
https://www.vupen.com/english/advisories/2011/0270
https://www.vupen.com/english/advisories/2011/0719
https://www.wireshark.org/security/wnpa-sec-2011-01.html
https://www.wireshark.org/security/wnpa-sec-2011-02.html
https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5676
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5530
https://exchange.xforce.ibmcloud.com/vulnerabilities/64624
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14283

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource management error

EUVDB-ID: #VU45460

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-0445

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The ASN.1 BER dissector in Wireshark 1.4.0 through 1.4.2 allows remote attackers to cause a denial of service (assertion failure) via crafted packets, as demonstrated by fuzz-2010-12-30-28473.pcap.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.4.0 - 1.4.2

CPE2.3

External links

https://lists.fedoraproject.org/pipermail/package-announce/2011-February/053650.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-February/053669.html
https://osvdb.org/70402
https://secunia.com/advisories/43175
https://www.securityfocus.com/bid/45775
https://www.vupen.com/english/advisories/2011/0079
https://www.vupen.com/english/advisories/2011/0270
https://www.wireshark.org/security/wnpa-sec-2011-02.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5537
https://exchange.xforce.ibmcloud.com/vulnerabilities/64625
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14505

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU45487

Risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2010-4538

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Buffer overflow in the sect_enttec_dmx_da function in epan/dissectors/packet-enttec.c in Wireshark 1.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ENTTEC DMX packet with Run Length Encoding (RLE) compression.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.4.2

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:1.4.2:*:*:*:*:*:*:*

External links

https://lists.fedoraproject.org/pipermail/package-announce/2011-January/053042.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-January/053061.html
https://openwall.com/lists/oss-security/2010/12/31/7
https://openwall.com/lists/oss-security/2011/01/03/8
https://osvdb.org/70244
https://secunia.com/advisories/42767
https://secunia.com/advisories/42853
https://secunia.com/advisories/42910
https://secunia.com/advisories/42914
https://www.debian.org/security/2011/dsa-2144
https://www.mandriva.com/security/advisories?name=MDVSA-2011:002
https://www.redhat.com/support/errata/RHSA-2011-0013.html
https://www.securityfocus.com/bid/45634
https://www.securitytracker.com/id?1024930
https://www.vupen.com/english/advisories/2011/0008
https://www.vupen.com/english/advisories/2011/0053
https://www.vupen.com/english/advisories/2011/0069
https://www.vupen.com/english/advisories/2011/0079
https://www.vupen.com/english/advisories/2011/0099
https://www.vupen.com/english/advisories/2011/0110
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5539
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14937

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

Risk	High
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2011-1143 CVE-2011-0444 CVE-2011-0445 CVE-2010-4538
CWE-ID	CWE-20 CWE-119 CWE-399
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #4 is available.
Vulnerable software	Wireshark Server applications / IDS/IPS systems, Firewalls and proxy servers
Vendor	Wireshark.org