Unspecified vulnerability in packet.c in the GSM A RR dissector in Wireshark 1.2.0 and 1.2.1 allows remote attackers to cause a denial of service (application crash) via unknown vectors related to "an uninitialized dissector handle," which triggers an assertion failure.

The remote host is affected by the vulnerability described in GLSA-200911-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark:
    Ryan Giobbi reported an integer overflow in wiretap/erf.c     (CVE-2009-3829).
    The vendor reported multiple unspecified     vulnerabilities in the Bluetooth L2CAP, RADIUS, and MIOP dissectors     (CVE-2009-2560), in the OpcUa dissector (CVE-2009-3241), in packet.c in     the GSM A RR dissector (CVE-2009-3242), in the TLS dissector     (CVE-2009-3243), in the Paltalk dissector (CVE-2009-3549), in the     DCERPC/NT dissector (CVE-2009-3550), and in the     dissect_negprot_response() function in packet-smb.c in the SMB     dissector (CVE-2009-3551).
  Impact :

    A remote attacker could entice a user to open a specially crafted 'erf'     file using Wireshark, possibly resulting in the execution of arbitrary     code with the privileges of the user running the application. A remote     attacker could furthermore send specially crafted packets on a network     being monitored by Wireshark or entice a user to open a malformed     packet trace file using Wireshark, possibly resulting in a Denial of     Service.
  Workaround :

    There is no known workaround at this time.

Update to Wireshark 1.2.2 fixing multiple security issues:
http://www.wireshark.org/docs/relnotes/wireshark-1.2.2.html http://www.wireshark.org/security/wnpa-sec-2009-06.html * The OpcUa dissector could use excessive CPU and memory. (Bug 3986) Versions affected: 0.99.6 to 1.0.8, 1.2.0 to 1.2.1 * The GSM A RR dissector could crash. (Bug 3893) Versions affected: 1.2.0 to 1.2.1 * The TLS dissector could crash on some platforms. (Bug 4008) Versions affected:
1.2.0 to 1.2.1 http://www.wireshark.org/docs/relnotes/wireshark-1.2.1.html http://www.wireshark.org/security/wnpa-sec-2009-04.html * The AFS dissector could crash. (Bug 3564) Versions affected: 0.9.2 to 1.2.0

  - The Infiniband dissector could crash on some platforms.
    Versions affected: 1.0.6 to 1.2.0 * The IPMI dissector     could overrun a buffer. (Bug 3559) Versions affected:
    1.2.0 * The Bluetooth L2CAP dissector could crash. (Bug     3572) Versions affected: 1.2.0 * The RADIUS dissector     could crash. (Bug 3578) Versions affected: 1.2.0 * The     MIOP dissector could crash. (Bug 3652) Versions     affected: 1.2.0 * The sFlow dissector could use     excessive CPU and memory. (Bug 3570) Versions affected:
    1.2.0 (Issues from wnpa-sec-2009-04 does not affect     users of Wireshark 1.2.1 packages from updates-testing.)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Wireshark or Ethereal is affected by multiple issues :

  - The GSM A RR dissector could crash. (Bug 3893)

  - The OpcUa dissector could use excessive CPU and memory.
    (Bug 3986)

  - The TLS dissector could crash on some platforms.
    (Bug 4008)

  - Wireshark could crash while reading an 'ERF' file.     (Bug 3849)

These vulnerabilities could result in a denial of service. A remote attacker could exploit these issues by tricking a user into opening a maliciously crafted capture file.  Additionally, if Wireshark is running in promiscuous mode, one of these issues could be exploited remotely (from the same network segment).

ID	Name	Product	Family	Severity
42915	GLSA-200911-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
42387	Fedora 11 : wireshark-1.2.2-1.fc11 (2009-9837)	Nessus	Fedora Local Security Checks	high
40999	Wireshark / Ethereal 0.9.6 to 1.2.1 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2009-3242

high

Tenable Plugins

high

high

medium