Off-by-one error in the dissect_negprot_response function in packet-smb.c in the SMB dissector in Wireshark 1.2.0 through 1.2.2 allows remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace. NOTE: some of these details are obtained from third party information.

Update of wireshark to fix multiple vulnerabilities :

  - The Paltalk dissector could crash on alignment-sensitive     processors. (CVE-2009-3549: CVSS v2 Base Score: 5.0     (MEDIUM))

  - The DCERPC/NT dissector could crash. (CVE-2009-3550:
    CVSS v2 Base Score: 4.3 (MEDIUM))

  - The SMB dissector could crash. (CVE-2009-3551: CVSS v2     Base Score: 5.0 (MEDIUM))

  - The RADIUS dissector could crash. (CVE-2009-2560: CVSS     v2 Base Score: 5.0 (MEDIUM))

Version upgrade of wireshark fix multiple vulnerabilities :

  - The Paltalk dissector could crash on alignment-sensitive     processors. (CVE-2009-3549: CVSS v2 Base Score: 5.0     (MEDIUM))

  - The DCERPC/NT dissector could crash. (CVE-2009-3550:
    CVSS v2 Base Score: 4.3 (MEDIUM))

  - The SMB dissector could crash. (CVE-2009-3551: CVSS v2     Base Score: 5.0 (MEDIUM))

  - The RADIUS dissector could crash. (CVE-2009-2560: CVSS     v2 Base Score: 5.0 (MEDIUM))

  - Fix for an integer overflow in wiretap/erf.c that     allowed remote attackers to execute arbitrary code via a     crafted ERF file. (CVE-2009-3829). (CVSS v2 Base Score:
    9.3 (HIGH))

Version upgrade of wireshark fix multiple vulnerabilities :

  - CVE-2009-3549: CVSS v2 Base Score: 5.0 (MEDIUM) The     Paltalk dissector could crash on alignment-sensitive     processors.

  - CVE-2009-3550: CVSS v2 Base Score: 4.3 (MEDIUM) The     DCERPC/NT dissector could crash.

  - CVE-2009-3551: CVSS v2 Base Score: 5.0 (MEDIUM) The SMB     dissector could crash.

  - CVE-2009-2560: CVSS v2 Base Score: 5.0 (MEDIUM) The     RADIUS dissector could crash.

  - CVE-2009-3829 CVSS v2 Base Score: 9.3 (HIGH) Fix for an     integer overflow in wiretap/erf.c that allowed remote     attackers to execute arbitrary code via a crafted ERF     file. This does not affect SLE products.

This is an update of wireshark to fix multiple vulnerabilities :

  - CVSS v2 Base Score: 5.0 (MEDIUM) The Paltalk dissector     could crash on alignment-sensitive processors.
    (CVE-2009-3549)

  - CVSS v2 Base Score: 4.3 (MEDIUM) The DCERPC/NT dissector     could crash. (CVE-2009-3550)

  - CVSS v2 Base Score: 5.0 (MEDIUM) The SMB dissector could     crash. (CVE-2009-3551)

  - CVSS v2 Base Score: 5.0 (MEDIUM) The RADIUS dissector     could crash. (CVE-2009-2560)

The remote host is affected by the vulnerability described in GLSA-200911-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark:
    Ryan Giobbi reported an integer overflow in wiretap/erf.c     (CVE-2009-3829).
    The vendor reported multiple unspecified     vulnerabilities in the Bluetooth L2CAP, RADIUS, and MIOP dissectors     (CVE-2009-2560), in the OpcUa dissector (CVE-2009-3241), in packet.c in     the GSM A RR dissector (CVE-2009-3242), in the TLS dissector     (CVE-2009-3243), in the Paltalk dissector (CVE-2009-3549), in the     DCERPC/NT dissector (CVE-2009-3550), and in the     dissect_negprot_response() function in packet-smb.c in the SMB     dissector (CVE-2009-3551).
  Impact :

    A remote attacker could entice a user to open a specially crafted 'erf'     file using Wireshark, possibly resulting in the execution of arbitrary     code with the privileges of the user running the application. A remote     attacker could furthermore send specially crafted packets on a network     being monitored by Wireshark or entice a user to open a malformed     packet trace file using Wireshark, possibly resulting in a Denial of     Service.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
49845	SuSE 10 Security Update : ethereal (ZYPP Patch Number 6628)	Nessus	SuSE Local Security Checks	medium
43085	SuSE 11 Security Update : wireshark (SAT Patch Number 1606)	Nessus	SuSE Local Security Checks	high
42958	SuSE 10 Security Update : ethereal (ZYPP Patch Number 6627)	Nessus	SuSE Local Security Checks	medium
42955	openSUSE Security Update : wireshark (wireshark-1600)	Nessus	SuSE Local Security Checks	high
42953	openSUSE Security Update : wireshark (wireshark-1600)	Nessus	SuSE Local Security Checks	high
42950	openSUSE Security Update : wireshark (wireshark-1600)	Nessus	SuSE Local Security Checks	high
42947	SuSE9 Security Update : ethereal (YOU Patch Number 12530)	Nessus	SuSE Local Security Checks	medium
42915	GLSA-200911-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2009-3551

high

Tenable Plugins

medium

high

medium

high

high

high

medium

high