Heap-based buffer overflow in the dissect_ldss_transfer function (epan/dissectors/packet-ldss.c) in the LDSS dissector in Wireshark 1.2.0 through 1.2.12 and 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an LDSS packet with a long digest line that triggers memory corruption.

Wireshark version 1.4.2 fixes several security issues that allowed attackers to crash wireshark or potentially even execute arbitrary code

(CVE-2010-1455, CVE-2010-2283, CVE-2010-2284, CVE-2010-2285, CVE-2010-2286, CVE-2010-2287, CVE-2010-2992, CVE-2010-2993, CVE-2010-2994, CVE-2010-2995, CVE-2010-3445, CVE-2010-4300, CVE-2010-4301)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0013 advisory.

    [1.2.13-1.0.1.el6_0.2]
    - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect       packets bug#11486

    [1.2.13-1.1]
    - fix buffer overflow in ENTTEC dissector
    - Resolves: #667337

    [1.2.13-1]
    - upgrade to 1.2.13
    - see http://www.wireshark.org/docs/relnotes/wireshark-1.2.11.html
    - see http://www.wireshark.org/docs/relnotes/wireshark-1.2.12.html
    - see http://www.wireshark.org/docs/relnotes/wireshark-1.2.13.html
    - Resolves: #657534 (CVE-2010-4300 CVE-2010-3445)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A heap-based buffer overflow flaw was found in the Wireshark Local Download Sharing Service (LDSS) dissector. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2010-4300)

A denial of service flaw was found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2010-3445)

All running instances of Wireshark must be restarted for the update to take effect.

Wireshark was updated to version 1.4.4 to fix several security issues.

The remote host is affected by the vulnerability described in GLSA-201110-02 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send specially crafted packets on a network       being monitored by Wireshark, entice a user to open a malformed packet       trace file using Wireshark, or deploy a specially crafted Lua script for       use by Wireshark, possibly resulting in the execution of arbitrary code,       or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Wireshark was updated to version 1.4.4 to fix several security issues

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0924 advisory.

  - wireshark: stack overflow in BER dissector (CVE-2010-3445)

  - Wireshark: Heap-based buffer overflow in LDSS dissector (CVE-2010-4300)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This advisory updates wireshark to the latest version (1.2.13), fixing one security issue :

Heap-based buffer overflow in the dissect_ldss_transfer function (epan/dissectors/packet-ldss.c) in the LDSS dissector in Wireshark 1.2.0 through 1.2.12 and 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an LDSS packet with a long digest line that triggers memory corruption (CVE-2010-4300).

The installed version of Wireshark is 1.2.x less than 1.2.13 or 1.4.x less than 1.4.2.  Such versions are affected by the following vulnerabilities:

  - An error exists in the LDSS dissector that allows     a series of malformed packets to cause a buffer     overflow. (5318)

  - An error exists in the ZigBee ZCL dissector that allows     a series of malformed packets to cause the dissector to     enter an infinite loop. (5303)

ID	Name	Product	Family	Severity
75771	openSUSE Security Update : wireshark (openSUSE-SU-2011:0010-2)	Nessus	SuSE Local Security Checks	critical
68179	Oracle Linux 5 / 6 : wireshark (ELSA-2011-0013)	Nessus	Oracle Linux Local Security Checks	high
60911	Scientific Linux Security Update : wireshark on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
57261	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7438)	Nessus	SuSE Local Security Checks	critical
56426	GLSA-201110-02 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
53808	openSUSE Security Update : wireshark (openSUSE-SU-2011:0010-2)	Nessus	SuSE Local Security Checks	critical
53689	openSUSE Security Update : wireshark (openSUSE-SU-2011:0010-1)	Nessus	SuSE Local Security Checks	critical
53319	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7439)	Nessus	SuSE Local Security Checks	critical
53315	SuSE 11.1 Security Update : wireshark (SAT Patch Number 4267)	Nessus	SuSE Local Security Checks	critical
50851	RHEL 6 : wireshark (RHSA-2010:0924)	Nessus	Red Hat Local Security Checks	high
50827	Mandriva Linux Security Advisory : wireshark (MDVSA-2010:242)	Nessus	Mandriva Local Security Checks	high
50678	Wireshark < 1.2.13 / 1.4.2 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2010-4300

critical

Tenable Plugins

critical

high

high

critical

critical

critical

critical

critical

critical

high

high

medium