SB2017090401 - Multiple vulnerabilities in Wireshark

Description

This security bulletin contains information about 4 vulnerabilities.

1) Infinite loop (CVE-ID: CVE-2017-13767)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to infinite loop in the MSDP dissector. A remote attacker can inject a malformed packet onto the wire, trigger Wireshark to consume excessive CPU resources and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

2) Out-of-bounds write (CVE-ID: CVE-2017-13766)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to out-of-bounds write in the Profinet I/O dissector. A remote attacker can inject a malformed packet onto the wire, trigger Wireshark to consume excessive CPU resources and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

3) Null pointer dereference (CVE-ID: CVE-2017-13764)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to NULL pointer dereference in the Modbus dissector. A remote attacker can inject a malformed packet onto the wire, trigger Wireshark to consume excessive CPU resources and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

4) Buffer over-read (CVE-ID: CVE-2017-13765)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to buffer over-read in the IrCOMM dissector. A remote attacker can inject a malformed packet onto the wire, trigger Wireshark to consume excessive CPU resources and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Remediation

Install update from vendor's website.

References

• https://www.wireshark.org/security/wnpa-sec-2017-38.html
• https://www.wireshark.org/security/wnpa-sec-2017-39.html
• https://www.wireshark.org/security/wnpa-sec-2017-40.html
• https://www.wireshark.org/security/wnpa-sec-2017-41.html