Wireshark 0.99.5 allows remote attackers to cause a denial of service (memory consumption) via a malformed DCP ETSI packet that triggers an infinite loop.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0710 advisory.

    [0.99.6-1.el5.01]
    - Added patch for OCFS2 formatting

    [0.99.6-1]
    - upgrade to 0.99.6
    - Wireshark could crash when dissecting an HTTP chunked response
    - Wireshark could crash while reading iSeries capture files
    - Wireshark could exhaust system memory while reading a       malformed DCP ETSI packet
    - Wireshark could loop excessively while reading a malformed SSL packet
    - Resolves: #247623

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2008:0059 :

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. Wireshark could crash or possibly execute arbitrary code as the user running Wireshark if it read a malformed packet off the network. (CVE-2007-6114, CVE-2007-6115, CVE-2007-6117)

Several denial of service bugs were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3392, CVE-2007-3393, CVE-2007-6113, CVE-2007-6118, CVE-2007-6120, CVE-2007-6121, CVE-2007-6450, CVE-2007-6451)

As well, Wireshark switched from using net-snmp to libsmi, which is included in this errata.

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 0.99.7, and resolve these issues.

New Wireshark packages that fix various security vulnerabilities and functionality bugs are now available for Red Hat Enterprise Linux 4.
Wireshark was previously known as Ethereal.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic.

Several denial of service bugs were found in Wireshark's HTTP, iSeries, DCP ETSI, SSL, MMS, DHCP and BOOTP protocol dissectors. It was possible for Wireshark to crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3393)

Wireshark would interpret certain completion codes incorrectly when dissecting IPMI traffic. Additionally, IPMI 2.0 packets would be reported as malformed IPMI traffic.

Users of Wireshark should upgrade to these updated packages containing Wireshark version 0.99.6, which correct these issues.

Several flaws were found in Wireshark. Wireshark could crash or possibly execute arbitrary code as the user running Wireshark if it read a malformed packet off the network. (CVE-2007-6112, CVE-2007-6114, CVE-2007-6115, CVE-2007-6117)

Several denial of service bugs were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3392, CVE-2007-3393, CVE-2007-6111, CVE-2007-6113, CVE-2007-6116, CVE-2007-6118, CVE-2007-6119, CVE-2007-6120, CVE-2007-6121, CVE-2007-6438, CVE-2007-6439, CVE-2007-6441, CVE-2007-6450, CVE-2007-6451)

As well, Wireshark switched from using net-snmp to libsmi, which is included in this errata.

Several denial of service bugs were found in Wireshark's HTTP, iSeries, DCP ETSI, SSL, MMS, DHCP and BOOTP protocol dissectors. It was possible for Wireshark to crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3393)

Wireshark would interpret certain completion codes incorrectly when dissecting IPMI traffic. Additionally, IPMI 2.0 packets would be reported as malformed IPMI traffic.

Several denial of service bugs were found in Wireshark's HTTP, iSeries, DCP ETSI, SSL, MMS, DHCP and BOOTP protocol dissectors. It was possible for Wireshark to crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3393)

Various security problems were fixed in the wireshark 0.99.6 release, which were backported to ethereal (predecessor of wireshark) :

  - Wireshark allowed remote attackers to cause a denial of     service (crash) via a crafted chunked encoding in an     HTTP response, possibly related to a zero-length     payload. (CVE-2007-3389)

  - Wireshark when running on certain systems, allowed     remote attackers to cause a denial of service (crash)     via crafted iSeries capture files that trigger a     SIGTRAP. (CVE-2007-3390)

  - Wireshark allowed remote attackers to cause a denial of     service (memory consumption) via a malformed DCP ETSI     packet that triggers an infinite loop. (CVE-2007-3391)

  - Wireshark allowed remote attackers to cause a denial of     service via malformed (1) SSL or (2) MMS packets that     trigger an infinite loop. (CVE-2007-3392)

  - Off-by-one error in the DHCP/BOOTP dissector in     Wireshark allowed remote attackers to cause a denial of     service (crash) via crafted DHCP-over-DOCSIS packets.
    (CVE-2007-3393)

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. Wireshark could crash or possibly execute arbitrary code as the user running Wireshark if it read a malformed packet off the network. (CVE-2007-6114, CVE-2007-6115, CVE-2007-6117)

Several denial of service bugs were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3392, CVE-2007-3393, CVE-2007-6113, CVE-2007-6118, CVE-2007-6120, CVE-2007-6121, CVE-2007-6450, CVE-2007-6451)

As well, Wireshark switched from using net-snmp to libsmi, which is included in this errata.

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 0.99.7, and resolve these issues.

New Wireshark packages that fix various security vulnerabilities are now available for Red Hat Enterprise Linux 5. Wireshark was previously known as Ethereal.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic.

Several denial of service bugs were found in Wireshark's HTTP, iSeries, DCP ETSI, SSL, MMS, DHCP and BOOTP protocol dissectors. It was possible for Wireshark to crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3393)

Users of Wireshark and Ethereal should upgrade to these updated packages, containing Wireshark version 0.99.6, which is not vulnerable to these issues.

Various security problems were fixed in the wireshark 0.99.6 release, which were backported :

CVE-2007-3389: Wireshark allowed remote attackers to cause a denial of service (crash) via a crafted chunked encoding in an HTTP response, possibly related to a zero-length payload.

CVE-2007-3390: Wireshark when running on certain systems, allowed remote attackers to cause a denial of service (crash) via crafted iSeries capture files that trigger a SIGTRAP.

CVE-2007-3391: Wireshark allowed remote attackers to cause a denial of service (memory consumption) via a malformed DCP ETSI packet that triggers an infinite loop.

CVE-2007-3392: Wireshark allowed remote attackers to cause a denial of service via malformed (1) SSL or (2) MMS packets that trigger an infinite loop.

CVE-2007-3393: Off-by-one error in the DHCP/BOOTP dissector in Wireshark allowed remote attackers to cause a denial of service (crash) via crafted DHCP-over-DOCSIS packets.

Various security problems were fixed in the wireshark 0.99.6 release, which were backported to ethereal (predecessor of wireshark) :

CVE-2007-3389: Wireshark allowed remote attackers to cause a denial of service (crash) via a crafted chunked encoding in an HTTP response, possibly related to a zero-length payload.

CVE-2007-3390: Wireshark when running on certain systems, allowed remote attackers to cause a denial of service (crash) via crafted iSeries capture files that trigger a SIGTRAP.

CVE-2007-3391: Wireshark allowed remote attackers to cause a denial of service (memory consumption) via a malformed DCP ETSI packet that triggers an infinite loop.

CVE-2007-3392: Wireshark allowed remote attackers to cause a denial of service via malformed (1) SSL or (2) MMS packets that trigger an infinite loop.

CVE-2007-3393: Off-by-one error in the DHCP/BOOTP dissector in Wireshark allowed remote attackers to cause a denial of service (crash) via crafted DHCP-over-DOCSIS packets.

The remote host is affected by the vulnerability described in GLSA-200708-12 (Wireshark: Multiple vulnerabilities)

    Wireshark doesn't properly handle chunked encoding in HTTP responses     (CVE-2007-3389), iSeries capture files (CVE-2007-3390), certain types     of DCP ETSI packets (CVE-2007-3391), and SSL or MMS packets     (CVE-2007-3392). An off-by-one error has been discovered in the     DHCP/BOOTP dissector when handling DHCP-over-DOCSIS packets     (CVE-2007-3393).
  Impact :

    A remote attacker could send specially crafted packets on a network     being monitored with Wireshark, possibly resulting in the execution of     arbitrary code with the privileges of the user running Wireshark which     might be the root user, or a Denial of Service.
  Workaround :

    In order to prevent root compromise, take network captures with tcpdump     and analyze them running Wireshark as a least privileged user.

A number of vulnerabilities in the Wireshark program were found that could cause crashes, excessive looping, or exhaustion of system memory.

This updated provides wireshark 0.99.6 which is not vulnerable to these issues.

wireshark Team reports :

It may be possible to make Wireshark or Ethereal crash or use up available memory by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

ID	Name	Product	Family	Severity
180623	Oracle Linux 5 : wireshark (ELSA-2007-0710)	Nessus	Oracle Linux Local Security Checks	high
67643	Oracle Linux 3 : wireshark (ELSA-2008-0059)	Nessus	Oracle Linux Local Security Checks	critical
67054	CentOS 4 : wireshark (CESA-2007:0709)	Nessus	CentOS Local Security Checks	high
60350	Scientific Linux Security Update : wireshark on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
60312	Scientific Linux Security Update : wireshark on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60291	Scientific Linux Security Update : wireshark on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
41137	SuSE9 Security Update : ethereal (YOU Patch Number 11574)	Nessus	SuSE Local Security Checks	high
30044	CentOS 3 : wireshark (CESA-2008:0059)	Nessus	CentOS Local Security Checks	critical
30035	RHEL 3 : wireshark (RHSA-2008:0059)	Nessus	Red Hat Local Security Checks	critical
29421	SuSE 10 Security Update : ethereal (ZYPP Patch Number 3888)	Nessus	SuSE Local Security Checks	high
28238	RHEL 4 : wireshark (RHSA-2007:0709)	Nessus	Red Hat Local Security Checks	high
27833	RHEL 5 : wireshark (RHSA-2007:0710)	Nessus	Red Hat Local Security Checks	high
27478	openSUSE 10 Security Update : wireshark (wireshark-3886)	Nessus	SuSE Local Security Checks	high
27208	openSUSE 10 Security Update : ethereal (ethereal-3885)	Nessus	SuSE Local Security Checks	high
25918	GLSA-200708-12 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
25698	Mandrake Linux Security Advisory : wireshark (MDKSA-2007:145)	Nessus	Mandriva Local Security Checks	high
25679	FreeBSD : wireshark -- Multiple problems (7fadc049-2ba0-11dc-9377-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2007-3391

high

Tenable Plugins

high

critical

high

critical

high

high

high

critical

critical

high

high

high

high

high

high

high

high