Multiple buffer overflows in Wireshark (formerly Ethereal) 0.99.0 through 0.99.6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) the SSL dissector or (2) the iSeries (OS/400) Communication trace file parser.

From Red Hat Security Advisory 2008:0059 :

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. Wireshark could crash or possibly execute arbitrary code as the user running Wireshark if it read a malformed packet off the network. (CVE-2007-6114, CVE-2007-6115, CVE-2007-6117)

Several denial of service bugs were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3392, CVE-2007-3393, CVE-2007-6113, CVE-2007-6118, CVE-2007-6120, CVE-2007-6121, CVE-2007-6450, CVE-2007-6451)

As well, Wireshark switched from using net-snmp to libsmi, which is included in this errata.

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 0.99.7, and resolve these issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0058 advisory.

    wireshark-0.99.7-1.el5.0.1:

     [0.99.7-1.el5.0.1]
     - Add oracle-ocfs2-network.patch

     [0.99.7-1]
     - upgrade to 0.99.7
     - switch to libsmi from net-snmp
     - disable ADNS due to its lack of Ipv6 support
     - Resolves: #397411

     libsmi-0.4.5-2.el5:

     [0.4.5-2]
     - Handle rpath problems in 64-bit systems (#209522).

     [0.4.5-1]
     - Update to 0.4.5.

     [0.4.4-1]
     - Update to 0.4.4.

     [0.4.3-1]
     - First build.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several flaws were found in Wireshark. Wireshark could crash or possibly execute arbitrary code as the user running Wireshark if it read a malformed packet off the network. (CVE-2007-6112, CVE-2007-6114, CVE-2007-6115, CVE-2007-6117)

Several denial of service bugs were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3392, CVE-2007-3393, CVE-2007-6111, CVE-2007-6113, CVE-2007-6116, CVE-2007-6118, CVE-2007-6119, CVE-2007-6120, CVE-2007-6121, CVE-2007-6438, CVE-2007-6439, CVE-2007-6441, CVE-2007-6450, CVE-2007-6451)

As well, Wireshark switched from using net-snmp to libsmi, which is included in this errata.

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. Wireshark could crash or possibly execute arbitrary code as the user running Wireshark if it read a malformed packet off the network. (CVE-2007-6112, CVE-2007-6114, CVE-2007-6115, CVE-2007-6117)

Several denial of service bugs were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off the network. (CVE-2007-6111, CVE-2007-6113, CVE-2007-6116, CVE-2007-6118, CVE-2007-6119, CVE-2007-6120, CVE-2007-6121, CVE-2007-6438, CVE-2007-6439, CVE-2007-6441, CVE-2007-6450, CVE-2007-6451)

As well, Wireshark switched from using net-snmp to libsmi, which is included in this errata.

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 0.99.7, and resolve these issues.

A number of vulnerabilities in the Wireshark program were found that could cause crashes, excessive looping, or arbitrary code execution.

This update provides Wireshark 0.99.7 which is not vulnerable to these issues.

An updated version of libsmi is also being provided, not because of security issues, but because this version of wireshark uses it instead of net-snmp for SNMP support.

Update :

This update is being reissued without libcap (kernel capabilities) support, as that is not required by the original released packages, and thus gave trouble for a number of users.

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. Wireshark could crash or possibly execute arbitrary code as the user running Wireshark if it read a malformed packet off the network. (CVE-2007-6114, CVE-2007-6115, CVE-2007-6117)

Several denial of service bugs were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3392, CVE-2007-3393, CVE-2007-6113, CVE-2007-6118, CVE-2007-6120, CVE-2007-6121, CVE-2007-6450, CVE-2007-6451)

As well, Wireshark switched from using net-snmp to libsmi, which is included in this errata.

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 0.99.7, and resolve these issues.

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6450     The RPL dissector could be tricked into an infinite     loop.

  - CVE-2007-6451     The CIP dissector could be tricked into excessive memory     allocation.

The remote host is affected by the vulnerability described in GLSA-200712-23 (Wireshark: Multiple vulnerabilities)

    Multiple buffer overflows and infinite loops were discovered in     multiple dissector and parser components, including those for MP3 and     NCP (CVE-2007-6111), PPP (CVE-2007-6112), DNP (CVE-2007-6113), SSL and     iSeries (OS/400) Communication traces (CVE-2007-6114), ANSI MAP     (CVE-2007-6115), Firebird/Interbase (CVE-2007-6116), HTTP     (CVE-2007-6117), MEGACO (CVE-2007-6118), DCP ETSI (CVE-2007-6119),     Bluetooth SDP (CVE-2007-6120), RPC Portmap (CVE-2007-6121), SMB     (CVE-2007-6438), IPv6 amd USB (CVE-2007-6439), WiMAX (CVE-2007-6441),     RPL (CVE-2007-6450), CIP (CVE-2007-6451). The vulnerabilities were     discovered by Stefan Esser, Beyond Security, Fabiodds, Peter Leeming,     Steve and ainsley.
  Impact :

    A remote attacker could send specially crafted packets on a network     being monitored with Wireshark or entice a user to open a specially     crafted file, possibly resulting in the execution of arbitrary code     with the privileges of the user running Wireshark (which might be the     root user), or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The Wireshark team reports of multiple vulnerabilities :

- Wireshark could crash when reading an MP3 file.

- Beyond Security discovered that Wireshark could loop excessively while reading a malformed DNP packet.

- Stefan Esser discovered a buffer overflow in the SSL dissector.

- The ANSI MAP dissector could be susceptible to a buffer overflow on some platforms.

- The Firebird/Interbase dissector could go into an infinite loop or crash.

- The NCP dissector could cause a crash.

- The HTTP dissector could crash on some systems while decoding chunked messages.

- The MEGACO dissector could enter a large loop and consume system resources.

- The DCP ETSI dissector could enter a large loop and consume system resources.

- Fabiodds discovered a buffer overflow in the iSeries (OS/400) Communication trace file parser.

- The PPP dissector could overflow a buffer.

- The Bluetooth SDP dissector could go into an infinite loop.

- A malformed RPC Portmap packet could cause a crash.

- The IPv6 dissector could loop excessively.

- The USB dissector could loop excessively or crash.

- The SMB dissector could crash.

- The RPL dissector could go into an infinite loop.

- The WiMAX dissector could crash due to unaligned access on some platforms.

- The CIP dissector could attempt to allocate a huge amount of memory and crash. Impact It may be possible to make Wireshark or Ethereal crash or use up available memory by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

upgrade to 0.99.7 fixes various security flaws.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Various flaws fixed by upgrade to 0.99.7

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to denial of service or execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6114     Stefan Esser discovered a buffer overflow in the SSL     dissector.'Fabiodds' discovered a buffer overflow in the     iSeries trace dissector.

  - CVE-2007-6117     A programming error was discovered in the HTTP     dissector, which may lead to denial of service.

  - CVE-2007-6118     The MEGACO dissector could be tricked into resource     exhaustion.

  - CVE-2007-6120     The Bluetooth SDP dissector could be tricked into an     endless loop.

  - CVE-2007-6121     The RPC portmap dissector could be tricked into     dereferencing a NULL pointer.

ID	Name	Product	Family	Severity
67643	Oracle Linux 3 : wireshark (ELSA-2008-0059)	Nessus	Oracle Linux Local Security Checks	critical
67642	Oracle Linux 5 : Moderate: / wireshark (ELSA-2008-0058)	Nessus	Oracle Linux Local Security Checks	high
60350	Scientific Linux Security Update : wireshark on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
43670	CentOS 4 / 5 : wireshark (CESA-2008:0058)	Nessus	CentOS Local Security Checks	critical
36583	Mandriva Linux Security Advisory : wireshark (MDVSA-2008:001-1)	Nessus	Mandriva Local Security Checks	critical
30044	CentOS 3 : wireshark (CESA-2008:0059)	Nessus	CentOS Local Security Checks	critical
30035	RHEL 3 : wireshark (RHSA-2008:0059)	Nessus	Red Hat Local Security Checks	critical
30034	RHEL 4 / 5 : wireshark (RHSA-2008:0058)	Nessus	Red Hat Local Security Checks	critical
29840	Debian DSA-1446-1 : wireshark - several vulnerabilities	Nessus	Debian Local Security Checks	critical
29820	GLSA-200712-23 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
29772	FreeBSD : wireshark -- multiple vulnerabilities (8a835235-ae84-11dc-a5f9-001a4d49522b)	Nessus	FreeBSD Local Security Checks	critical
29766	Fedora 7 : wireshark-0.99.7-1.fc7 (2007-4690)	Nessus	Fedora Local Security Checks	critical
29760	Fedora 8 : wireshark-0.99.7-2.fc8 (2007-4590)	Nessus	Fedora Local Security Checks	critical
28337	Debian DSA-1414-1 : wireshark - several vulnerabilities	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2007-6114

critical

Tenable Plugins

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical