Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed NetScreen snoop file.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0313 advisory.

    [1.0.6-2.0.1.el5_3]
    - Add oracle-ocfs2-network.patch

    [1.0.6-2]
    - bring back pie
    - Resolves: #486551

    [1.0.6-1]
    - various security flaws fixed
    - upgrade to 1.0.6
    - Resolves: #486551

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malformed dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-4683, CVE-2009-0599)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malformed dump file. (CVE-2008-4680, CVE-2008-4681, CVE-2008-4682,CVE-2008-4684, CVE-2008-4685, CVE-2008-5285, CVE-2009-0600)

All running instances of Wireshark must be restarted for the update to take effect.

wireshark: fixed crashes while reading capture files containing NetScreen data (CVE-2009-0599), Tektronix K12 capture files (CVE-2009-0600) and and a format string vulnerability (CVE-2009-0601).

The remote host is affected by the vulnerability described in GLSA-200906-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark:
    David Maciejak discovered a vulnerability in packet-usb.c in the USB     dissector via a malformed USB Request Block (URB) (CVE-2008-4680).
    Florent Drouin and David Maciejak reported an unspecified vulnerability     in the Bluetooth RFCOMM dissector (CVE-2008-4681).
    A malformed Tamos CommView capture file (aka .ncf file) with an     'unknown/unexpected packet type' triggers a failed assertion in wtap.c     (CVE-2008-4682).
    An unchecked packet length parameter in the dissect_btacl() function in     packet-bthci_acl.c in the Bluetooth ACL dissector causes an erroneous     tvb_memcpy() call (CVE-2008-4683).
    A vulnerability where packet-frame does not properly handle exceptions     thrown by post dissectors caused by a certain series of packets     (CVE-2008-4684).
    Mike Davies reported a use-after-free vulnerability in the     dissect_q931_cause_ie() function in packet-q931.c in the Q.931     dissector via certain packets that trigger an exception     (CVE-2008-4685).
    The Security Vulnerability Research Team of Bkis reported that the SMTP     dissector could consume excessive amounts of CPU and memory     (CVE-2008-5285).
    The vendor reported that the WLCCP dissector could go into an infinite     loop (CVE-2008-6472).
    babi discovered a buffer overflow in wiretap/netscreen.c via a     malformed NetScreen snoop file (CVE-2009-0599).
    A specially crafted Tektronix K12 text capture file can cause an     application crash (CVE-2009-0600).
    A format string vulnerability via format string specifiers in the HOME     environment variable (CVE-2009-0601).
    THCX Labs reported a format string vulnerability in the     PROFINET/DCP (PN-DCP) dissector via a PN-DCP packet with format string     specifiers in the station name (CVE-2009-1210).
    An unspecified vulnerability with unknown impact and attack vectors     (CVE-2009-1266).
    Marty Adkins and Chris Maynard discovered a parsing error in the     dissector for the Check Point High-Availability Protocol (CPHAP)     (CVE-2009-1268).
    Magnus Homann discovered a parsing error when loading a Tektronix .rf5     file (CVE-2009-1269).
    The vendor reported that the PCNFSD dissector could crash     (CVE-2009-1829).
  Impact :

    A remote attacker could exploit these vulnerabilities by sending     specially crafted packets on a network being monitored by Wireshark or     by enticing a user to read a malformed packet trace file which can     trigger a Denial of Service (application crash or excessive CPU and     memory usage) and possibly allow for the execution of arbitrary code     with the privileges of the user running Wireshark.
  Workaround :

    There is no known workaround at this time.

Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed NetScreen snoop file.
(CVE-2009-0599)

Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted Tektronix K12 text capture file, as demonstrated by a file with exactly one frame. (CVE-2009-0600)

Format string vulnerability in Wireshark 0.99.8 through 1.0.5 on non-Windows platforms allows local users to cause a denial of service (application crash) via format string specifiers in the HOME environment variable. (CVE-2009-0601)

This update provides Wireshark 1.0.6, which is not vulnerable to these issues.

Few minor security issues were fixed in new version of wireshark.
Security- related bugs in the Tektronix K12 and NetScreen file formats have been fixed.
http://www.wireshark.org/security/wnpa-sec-2009-01.html NFSv4.1: Add support for backchannel decoding - Dynamically registers a callback dissector based on the CREATE_SESSION args. - Supports the decoding of CB_SEQUENCE, CB_RECALL, CB_LAYOUTRECALL operations

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vendor reports :

On non-Windows systems Wireshark could crash if the HOME environment variable contained sprintf-style string formatting characters.
Wireshark could crash while reading a malformed NetScreen snoop file.
Wireshark could crash while reading a Tektronix K12 text capture file.

Minor security issues are fixed in new version of wireshark.
Security-related bugs in the Tektronix K12 and NetScreen file formats have been fixed.
http://www.wireshark.org/security/wnpa-sec-2009-01.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malformed dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-4683, CVE-2009-0599)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malformed dump file. (CVE-2008-4680, CVE-2008-4681, CVE-2008-4682, CVE-2008-4684, CVE-2008-4685, CVE-2008-5285, CVE-2009-0600)

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.6, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.

The installed version of Wireshark or Ethereal is affected by multiple denial of service issues :

  - Wireshark could crash while reading a malformed NetScreen     snoop file. (Bug 3151)

  - Wireshark could crash while reading a Tektronix K12     text capture file. (Bug 1937)

ID	Name	Product	Family	Severity
67809	Oracle Linux 5 : wireshark (ELSA-2009-0313)	Nessus	Oracle Linux Local Security Checks	high
60541	Scientific Linux Security Update : wireshark on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
40322	openSUSE Security Update : wireshark (wireshark-539)	Nessus	SuSE Local Security Checks	medium
40153	openSUSE Security Update : wireshark (wireshark-539)	Nessus	SuSE Local Security Checks	medium
39580	GLSA-200906-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
37419	Mandriva Linux Security Advisory : wireshark (MDVSA-2009:058)	Nessus	Mandriva Local Security Checks	medium
37388	Fedora 10 : wireshark-1.0.6-1.fc10 (2009-1798)	Nessus	Fedora Local Security Checks	medium
35990	FreeBSD : wireshark -- multiple vulnerabilities (f6f19735-9245-4918-8a60-87948ebb4907)	Nessus	FreeBSD Local Security Checks	medium
35933	Fedora 9 : wireshark-1.0.6-1.fc9 (2009-1877)	Nessus	Fedora Local Security Checks	medium
35772	RHEL 3 / 4 / 5 : wireshark (RHSA-2009:0313)	Nessus	Red Hat Local Security Checks	medium
35767	CentOS 3 / 4 : wireshark (CESA-2009:0313)	Nessus	CentOS Local Security Checks	medium
35729	openSUSE 10 Security Update : wireshark (wireshark-6007)	Nessus	SuSE Local Security Checks	medium
35629	Wireshark / Ethereal 0.99.6 to 1.0.5 Multiple Denial of Service Vulnerabilities	Nessus	Windows	low

Detections

Analytics

CVE-2009-0599

critical

Tenable Plugins

high

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

low