Unspecified vulnerability in the OpcUa (OPC UA) dissector in Wireshark 0.99.6 through 1.0.8 and 1.2.0 through 1.2.1 allows remote attackers to cause a denial of service (memory and CPU consumption) via malformed OPCUA Service CallRequest packets.

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2560     A NULL pointer dereference was found in the RADIUS     dissector.

  - CVE-2009-3550     A NULL pointer dereference was found in the DCERP/NT     dissector.

  - CVE-2009-3829     An integer overflow was discovered in the ERF parser.

This update also includes fixes for three minor issues (CVE-2008-1829, CVE-2009-2562, CVE-2009-3241 ), which were scheduled for the next stable point update. Also CVE-2009-1268 was fixed for Etch. Since this security update was issued prior to the release of the point update, the fixes were included.

The remote host is affected by the vulnerability described in GLSA-200911-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark:
    Ryan Giobbi reported an integer overflow in wiretap/erf.c     (CVE-2009-3829).
    The vendor reported multiple unspecified     vulnerabilities in the Bluetooth L2CAP, RADIUS, and MIOP dissectors     (CVE-2009-2560), in the OpcUa dissector (CVE-2009-3241), in packet.c in     the GSM A RR dissector (CVE-2009-3242), in the TLS dissector     (CVE-2009-3243), in the Paltalk dissector (CVE-2009-3549), in the     DCERPC/NT dissector (CVE-2009-3550), and in the     dissect_negprot_response() function in packet-smb.c in the SMB     dissector (CVE-2009-3551).
  Impact :

    A remote attacker could entice a user to open a specially crafted 'erf'     file using Wireshark, possibly resulting in the execution of arbitrary     code with the privileges of the user running the application. A remote     attacker could furthermore send specially crafted packets on a network     being monitored by Wireshark or entice a user to open a malformed     packet trace file using Wireshark, possibly resulting in a Denial of     Service.
  Workaround :

    There is no known workaround at this time.

Update to Wireshark 1.2.2 fixing multiple security issues:
http://www.wireshark.org/docs/relnotes/wireshark-1.2.2.html http://www.wireshark.org/security/wnpa-sec-2009-06.html * The OpcUa dissector could use excessive CPU and memory. (Bug 3986) Versions affected: 0.99.6 to 1.0.8, 1.2.0 to 1.2.1 * The GSM A RR dissector could crash. (Bug 3893) Versions affected: 1.2.0 to 1.2.1 * The TLS dissector could crash on some platforms. (Bug 4008) Versions affected:
1.2.0 to 1.2.1 http://www.wireshark.org/docs/relnotes/wireshark-1.2.1.html http://www.wireshark.org/security/wnpa-sec-2009-04.html * The AFS dissector could crash. (Bug 3564) Versions affected: 0.9.2 to 1.2.0

  - The Infiniband dissector could crash on some platforms.
    Versions affected: 1.0.6 to 1.2.0 * The IPMI dissector     could overrun a buffer. (Bug 3559) Versions affected:
    1.2.0 * The Bluetooth L2CAP dissector could crash. (Bug     3572) Versions affected: 1.2.0 * The RADIUS dissector     could crash. (Bug 3578) Versions affected: 1.2.0 * The     MIOP dissector could crash. (Bug 3652) Versions     affected: 1.2.0 * The sFlow dissector could use     excessive CPU and memory. (Bug 3570) Versions affected:
    1.2.0 (Issues from wnpa-sec-2009-04 does not affect     users of Wireshark 1.2.1 packages from updates-testing.)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in wireshark :

Unspecified vulnerability in the OpcUa (OPC UA) dissector in Wireshark 0.99.6 through 1.0.8 and 1.2.0 through 1.2.1 allows remote attackers to cause a denial of service (memory and CPU consumption) via malformed OPCUA Service CallRequest packets (CVE-2009-3241).

This update fixes this vulnerability.

Specially crafted packets could crash the OPC UA dissector in Wireshark (CVE-2009-3241)

The installed version of Wireshark or Ethereal is affected by multiple issues :

  - The GSM A RR dissector could crash. (Bug 3893)

  - The OpcUa dissector could use excessive CPU and memory.
    (Bug 3986)

  - The TLS dissector could crash on some platforms.
    (Bug 4008)

  - Wireshark could crash while reading an 'ERF' file.     (Bug 3849)

These vulnerabilities could result in a denial of service. A remote attacker could exploit these issues by tricking a user into opening a maliciously crafted capture file.  Additionally, if Wireshark is running in promiscuous mode, one of these issues could be exploited remotely (from the same network segment).

ID	Name	Product	Family	Severity
44807	Debian DSA-1942-1 : wireshark - several vulnerabilities	Nessus	Debian Local Security Checks	high
42915	GLSA-200911-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
42387	Fedora 11 : wireshark-1.2.2-1.fc11 (2009-9837)	Nessus	Fedora Local Security Checks	high
42096	Mandriva Linux Security Advisory : wireshark (MDVSA-2009:270)	Nessus	Mandriva Local Security Checks	high
42070	openSUSE 10 Security Update : wireshark (wireshark-6533)	Nessus	SuSE Local Security Checks	high
42069	openSUSE Security Update : wireshark (wireshark-1363)	Nessus	SuSE Local Security Checks	high
42068	openSUSE Security Update : wireshark (wireshark-1363)	Nessus	SuSE Local Security Checks	high
40999	Wireshark / Ethereal 0.9.6 to 1.2.1 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2009-3241

high

Tenable Plugins

high

high

high

high

high

high

high

medium