SB2013020302 - Multiple vulnerabilities in Wireshark
Published: February 3, 2013 Updated: August 11, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 19 secuirty vulnerabilities.
1) Resource management error (CVE-ID: CVE-2013-1579)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The rtps_util_add_bitmap function in epan/dissectors/packet-rtps.c in the RTPS dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly implement certain nested loops for processing bitmap data, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
2) Input validation error (CVE-ID: CVE-2013-1580)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The dissect_cmstatus_tlv function in plugins/docsis/packet-cmstatus.c in the DOCSIS CM-STATUS dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 uses an incorrect data type for a position variable, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
3) Input validation error (CVE-ID: CVE-2013-1581)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The dissect_pft_fec_detailed function in epan/dissectors/packet-dcp-etsi.c in the DCP-ETSI dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle fragment gaps, which allows remote attackers to cause a denial of service (loop) via a malformed packet.
4) Input validation error (CVE-ID: CVE-2013-1582)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The dissect_clnp function in epan/dissectors/packet-clnp.c in the CLNP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly manage an offset variable, which allows remote attackers to cause a denial of service (infinite loop or application crash) via a malformed packet.
5) Input validation error (CVE-ID: CVE-2013-1583)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The dissect_version_4_primary_header function in epan/dissectors/packet-dtn.c in the DTN dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 accesses an inappropriate pointer, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
6) Input validation error (CVE-ID: CVE-2013-1584)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The dissect_version_5_and_6_primary_header function in epan/dissectors/packet-dtn.c in the DTN dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 accesses an inappropriate pointer, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
7) Input validation error (CVE-ID: CVE-2013-1585)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
epan/tvbuff.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly validate certain length values for the MS-MMC dissector, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
8) Input validation error (CVE-ID: CVE-2013-1586)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The fragment_set_tot_len function in epan/reassemble.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly determine the length of a reassembled packet for the DTLS dissector, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
9) Input validation error (CVE-ID: CVE-2013-1587)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The dissect_rohc_ir_packet function in epan/dissectors/packet-rohc.c in the ROHC dissector in Wireshark 1.8.x before 1.8.5 does not properly handle unknown profiles, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
10) Buffer overflow (CVE-ID: CVE-2013-1588)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
Multiple buffer overflows in the dissect_pft_fec_detailed function in the DCP-ETSI dissector in epan/dissectors/packet-dcp-etsi.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 allow remote attackers to cause a denial of service (application crash) via a malformed packet.
11) Resource management error (CVE-ID: CVE-2013-1589)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
Double free vulnerability in epan/proto.c in the dissection engine in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 allows remote attackers to cause a denial of service (application crash) via a malformed packet.
12) Buffer overflow (CVE-ID: CVE-2013-1590)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
Buffer overflow in the NTLMSSP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 allows remote attackers to cause a denial of service (application crash) via a malformed packet.
13) Input validation error (CVE-ID: CVE-2013-1573)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle a large number of padding bits, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
14) Input validation error (CVE-ID: CVE-2013-1574)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The dissect_bthci_eir_ad_data function in epan/dissectors/packet-bthci_cmd.c in the Bluetooth HCI dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 uses an incorrect data type for a counter variable, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
15) Input validation error (CVE-ID: CVE-2013-1575)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The dissect_r3_cmd_alarmconfigure function in epan/dissectors/packet-assa_r3.c in the R3 dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle a certain alarm length, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
16) Cryptographic issues (CVE-ID: CVE-2013-1576)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The dissect_sdp_media_attribute function in epan/dissectors/packet-sdp.c in the SDP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly process crypto-suite parameters, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
17) Input validation error (CVE-ID: CVE-2013-1577)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The dissect_sip_p_charging_func_addresses function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle offset data associated with a quoted string, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
18) Input validation error (CVE-ID: CVE-2013-1578)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The dissect_pw_eth_heuristic function in epan/dissectors/packet-pw-eth.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle apparent Ethernet address values at the beginning of MPLS data, which allows remote attackers to cause a denial of service (loop) via a malformed packet.
19) Input validation error (CVE-ID: CVE-2013-1572)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The dissect_oampdu_event_notification function in epan/dissectors/packet-slowprotocols.c in the IEEE 802.3 Slow Protocols dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle certain short lengths, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
Remediation
Install update from vendor's website.
References
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-rtps.c?r1=47046&r2=47045&pathrev=47046
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=47046
- http://lists.opensuse.org/opensuse-updates/2013-02/msg00028.html
- http://lists.opensuse.org/opensuse-updates/2013-02/msg00037.html
- http://www.wireshark.org/security/wnpa-sec-2013-01.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8198
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16230
- http://anonsvn.wireshark.org/viewvc/trunk/plugins/docsis/packet-cmstatus.c?r1=47045&r2=47044&pathrev=47045
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=47045
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8199
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15509
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcp-etsi.c?r1=47123&r2=47122&pathrev=47123
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=47123
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8222
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16370
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-clnp.c?r1=45646&r2=45645&pathrev=45646
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=45646
- http://www.debian.org/security/2013/dsa-2625
- http://www.wireshark.org/security/wnpa-sec-2013-02.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7871
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16426
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dtn.c?r1=46577&r2=46576&pathrev=46577
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=46577
- http://www.wireshark.org/security/wnpa-sec-2013-03.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7945
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16304
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dtn.c?r1=46579&r2=46578&pathrev=46579
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=46579
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16092
- http://anonsvn.wireshark.org/viewvc/trunk/epan/tvbuff.c?r1=46705&r2=46704&pathrev=46705
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=46705
- http://www.wireshark.org/security/wnpa-sec-2013-04.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8112
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15801
- http://anonsvn.wireshark.org/viewvc/trunk/epan/reassemble.c?r1=46999&r2=46998&pathrev=46999
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=46999
- http://www.wireshark.org/security/wnpa-sec-2013-05.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8111
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16048
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-rohc.c?r1=44700&r2=44699&pathrev=44700
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=44700
- http://www.wireshark.org/security/wnpa-sec-2013-06.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7679
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16462
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcp-etsi.c?r1=47098&r2=47097&pathrev=47098
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=47098
- http://www.wireshark.org/security/wnpa-sec-2013-07.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8213
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16402
- http://anonsvn.wireshark.org/viewvc/trunk/epan/proto.c?r1=47114&r2=47113&pathrev=47114
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=47114
- http://www.wireshark.org/security/wnpa-sec-2013-08.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8197
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16319
- http://www.wireshark.org/security/wnpa-sec-2013-09.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16004
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-csn1.c?r1=46335&r2=46334&pathrev=46335
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=46335
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8037
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16016
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-bthci_cmd.c?r1=46345&r2=46344&pathrev=46345
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=46345
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8038
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16323
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-assa_r3.c?r1=46415&r2=46414&pathrev=46415
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=46415
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8040
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16291
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-sdp.c?r1=46344&r2=46343&pathrev=46344
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=46344
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8041
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16450
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-sip.c?r1=46340&r2=46339&pathrev=46340
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=46340
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8042
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16253
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-pw-eth.c?r1=46420&r2=46419&pathrev=46420
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=46420
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8043
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16205
- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-slowprotocols.c?r1=46336&r2=46335&pathrev=46336
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=46336
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8036
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16423