#VU45487 Buffer overflow in Wireshark - CVE-2010-4538
Vulnerability identifier: #VU45487
Vulnerability risk: High
CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]
CVE-ID:
CWE-ID:
CWE-119
Exploitation vector: Network
Exploit availability: Yes
Vulnerable software:
Wireshark
Server applications /
IDS/IPS systems, Firewalls and proxy servers
Vendor: Wireshark.org
Description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Buffer overflow in the sect_enttec_dmx_da function in epan/dissectors/packet-enttec.c in Wireshark 1.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ENTTEC DMX packet with Run Length Encoding (RLE) compression.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Wireshark: 1.4.2
External links
https://lists.fedoraproject.org/pipermail/package-announce/2011-January/053042.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-January/053061.html
https://openwall.com/lists/oss-security/2010/12/31/7
https://openwall.com/lists/oss-security/2011/01/03/8
https://osvdb.org/70244
https://secunia.com/advisories/42767
https://secunia.com/advisories/42853
https://secunia.com/advisories/42910
https://secunia.com/advisories/42914
https://www.debian.org/security/2011/dsa-2144
https://www.mandriva.com/security/advisories?name=MDVSA-2011:002
https://www.redhat.com/support/errata/RHSA-2011-0013.html
https://www.securityfocus.com/bid/45634
https://www.securitytracker.com/id?1024930
https://www.vupen.com/english/advisories/2011/0008
https://www.vupen.com/english/advisories/2011/0053
https://www.vupen.com/english/advisories/2011/0069
https://www.vupen.com/english/advisories/2011/0079
https://www.vupen.com/english/advisories/2011/0099
https://www.vupen.com/english/advisories/2011/0110
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5539
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14937
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
