The snoop_read function in wiretap/snoop.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 does not properly handle certain virtualizable buffers, which allows remote attackers to cause a denial of service (application crash) via a large length value in a snoop file that triggers a stack-based buffer over-read.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Wireshark: Dos due to integer overflow in IPTrace capture format parser (CVE-2012-0067)

  - Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows user-assisted remote attackers to cause a     denial of service (NULL pointer dereference and application crash) via a crafted Diameter dictionary file.
    (CVE-2011-1958)

  - The snoop_read function in wiretap/snoop.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 does     not properly handle certain virtualizable buffers, which allows remote attackers to cause a denial of     service (application crash) via a large length value in a snoop file that triggers a stack-based buffer     over-read. (CVE-2011-1959)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update of wireshark fixes the following vulnerabilities :

  - CVE-2011-3266: Wireshark IKE dissector vulnerability

  - CVE-2011-3360: Wireshark Lua script execution     vulnerability

  - CVE-2011-3483: Wireshark buffer exception handling     vulnerability

  - CVE-2011-2597: Lucent/Ascend file parser susceptible to     infinite loop

  - CVE-2011-2698: ANSI MAP dissector susceptible to     infinite loop

  - CVE-2011-1957: Large/infinite loop in the DICOM     dissector

  - CVE-2011-1959: A corrupted snoop file could crash     Wireshark

  - CVE-2011-2174: Malformed compressed capture data could     crash Wireshark

  - CVE-2011-2175: A corrupted Visual Networks file could     crash Wireshark

  - CVE-2011-1958: dereferene a NULL pointer if we had a     corrupted Diameter dictionary

This update of wireshark fixes the following vulnerabilities :

  - CVE-2011-3266: Wireshark IKE dissector vulnerability

  - CVE-2011-3360: Wireshark Lua script execution     vulnerability

  - CVE-2011-3483: Wireshark buffer exception handling     vulnerability 

  - CVE-2011-2597: Lucent/Ascend file parser susceptible to     infinite loop

  - CVE-2011-2698: ANSI MAP dissector susceptible to     infinite loop 

  - CVE-2011-1957: Large/infinite loop in the DICOM     dissector

  - CVE-2011-1959: A corrupted snoop file could crash     Wireshark

  - CVE-2011-2174: Malformed compressed capture data could     crash Wireshark

  - CVE-2011-2175: A corrupted Visual Networks file could     crash Wireshark

  - CVE-2011-1958: dereferene a NULL pointer if we had a     corrupted Diameter dictionary

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0125 advisory.

    - fixed CVE-2012-4285, CVE-2012-4289, CVE-2012-4291 and CVE-2012-4290       (#849521)
    - fixed various flaws: CVE-2011-1959 CVE-2011-2175 CVE-2011-1958       CVE-2011-2698 CVE-2011-4102 CVE-2012-0041 CVE-2012-0042 CVE-2012-0066       CVE-2012-0067

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0509 advisory.

    [1.2.15-2.0.1.el6_2.1]
    - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect

    [1.2.15-2.1]
    - security patches
    - Resolves: CVE-2011-1143                 CVE-2011-1590                 CVE-2011-1957                 CVE-2011-1959                 CVE-2011-2174                 CVE-2011-2175 CVE-2011-1958                 CVE-2011-2597 CVE-2011-2698                 CVE-2011-4102                 CVE-2012-0041 CVE-2012-0066 CVE-2012-0067                 CVE-2012-0042                 CVE-2012-1595

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A heap-based buffer overflow flaw was found in the way Wireshark handled Endace ERF (Extensible Record Format) capture files. If Wireshark opened a specially- crafted ERF capture file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-4102)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066, CVE-2012-0067, CVE-2012-4285, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291)

This update also fixes the following bugs :

  - When Wireshark starts with the X11 protocol being     tunneled through an SSH connection, it automatically     prepares its capture filter to omit the SSH packets. If     the SSH connection was to a link-local IPv6 address     including an interface name (for example ssh -X     [ipv6addr]%eth0), Wireshark parsed this address     erroneously, constructed an incorrect capture filter and     refused to capture packets. The 'Invalid capture filter'     message was displayed. With this update, parsing of     link-local IPv6 addresses is fixed and Wireshark     correctly prepares a capture filter to omit SSH packets     over a link-local IPv6 connection.

  - Previously, Wireshark's column editing dialog malformed     column names when they were selected. With this update,     the dialog is fixed and no longer breaks column names.

  - Previously, TShark, the console packet analyzer, did not     properly analyze the exit code of Dumpcap, Wireshark's     packet capturing back end. As a result, TShark returned     exit code 0 when Dumpcap failed to parse its     command-line arguments. In this update, TShark correctly     propagates the Dumpcap exit code and returns a non-zero     exit code when Dumpcap fails.

  - Previously, the TShark '-s' (snapshot length) option     worked only for a value greater than 68 bytes. If a     lower value was specified, TShark captured just 68 bytes     of incoming packets. With this update, the '-s' option     is fixed and sizes lower than 68 bytes work as expected.

This update also adds the following enhancement :

  - In this update, support for the 'NetDump' protocol was     added.

All running instances of Wireshark must be restarted for the update to take effect.

Updated wireshark packages that fix several security issues, three bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Wireshark, previously known as Ethereal, is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network.

A heap-based buffer overflow flaw was found in the way Wireshark handled Endace ERF (Extensible Record Format) capture files. If Wireshark opened a specially crafted ERF capture file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-4102)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066, CVE-2012-0067, CVE-2012-4285, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291)

The CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, and CVE-2011-4102 issues were discovered by Huzaifa Sidhpurwala of the Red Hat Security Response Team.

This update also fixes the following bugs :

* When Wireshark starts with the X11 protocol being tunneled through an SSH connection, it automatically prepares its capture filter to omit the SSH packets. If the SSH connection was to a link-local IPv6 address including an interface name (for example ssh -X [ipv6addr]%eth0), Wireshark parsed this address erroneously, constructed an incorrect capture filter and refused to capture packets. The 'Invalid capture filter' message was displayed. With this update, parsing of link-local IPv6 addresses is fixed and Wireshark correctly prepares a capture filter to omit SSH packets over a link-local IPv6 connection. (BZ#438473)

* Previously, Wireshark's column editing dialog malformed column names when they were selected. With this update, the dialog is fixed and no longer breaks column names. (BZ#493693)

* Previously, TShark, the console packet analyzer, did not properly analyze the exit code of Dumpcap, Wireshark's packet capturing back end. As a result, TShark returned exit code 0 when Dumpcap failed to parse its command-line arguments. In this update, TShark correctly propagates the Dumpcap exit code and returns a non-zero exit code when Dumpcap fails. (BZ#580510)

* Previously, the TShark '-s' (snapshot length) option worked only for a value greater than 68 bytes. If a lower value was specified, TShark captured just 68 bytes of incoming packets. With this update, the '-s' option is fixed and sizes lower than 68 bytes work as expected.
(BZ#580513)

This update also adds the following enhancement :

* In this update, support for the 'NetDump' protocol was added.
(BZ#484999)

All users of Wireshark are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. All running instances of Wireshark must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0125 advisory.

    Wireshark, previously known as Ethereal, is a network protocol analyzer. It     is used to capture and browse the traffic running on a computer network.

    A heap-based buffer overflow flaw was found in the way Wireshark handled     Endace ERF (Extensible Record Format) capture files. If Wireshark opened a     specially-crafted ERF capture file, it could crash or, possibly, execute     arbitrary code as the user running Wireshark. (CVE-2011-4102)

    Several denial of service flaws were found in Wireshark. Wireshark could     crash or stop responding if it read a malformed packet off a network, or     opened a malicious dump file. (CVE-2011-1958, CVE-2011-1959, CVE-2011-2175,     CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066, CVE-2012-0067,     CVE-2012-4285, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291)

    The CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, and CVE-2011-4102 issues     were discovered by Huzaifa Sidhpurwala of the Red Hat Security Response     Team.

    This update also fixes the following bugs:

    * When Wireshark starts with the X11 protocol being tunneled through an SSH     connection, it automatically prepares its capture filter to omit the SSH     packets. If the SSH connection was to a link-local IPv6 address including     an interface name (for example ssh -X [ipv6addr]%eth0), Wireshark parsed     this address erroneously, constructed an incorrect capture filter and     refused to capture packets. The Invalid capture filter message was     displayed. With this update, parsing of link-local IPv6 addresses is fixed     and Wireshark correctly prepares a capture filter to omit SSH packets over     a link-local IPv6 connection. (BZ#438473)

    * Previously, Wireshark's column editing dialog malformed column names when     they were selected. With this update, the dialog is fixed and no longer     breaks column names. (BZ#493693)

    * Previously, TShark, the console packet analyzer, did not properly analyze     the exit code of Dumpcap, Wireshark's packet capturing back end. As a     result, TShark returned exit code 0 when Dumpcap failed to parse its     command-line arguments. In this update, TShark correctly propagates the     Dumpcap exit code and returns a non-zero exit code when Dumpcap fails.
    (BZ#580510)

    * Previously, the TShark -s (snapshot length) option worked only for a     value greater than 68 bytes. If a lower value was specified, TShark     captured just 68 bytes of incoming packets. With this update, the -s     option is fixed and sizes lower than 68 bytes work as expected. (BZ#580513)

    This update also adds the following enhancement:

    * In this update, support for the NetDump protocol was added. (BZ#484999)

    All users of Wireshark are advised to upgrade to these updated packages,     which contain backported patches to correct these issues and add this     enhancement. All running instances of Wireshark must be restarted for the     update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-1590, CVE-2011-4102, CVE-2012-1595)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1143, CVE-2011-1957, CVE-2011-1958, CVE-2011-1959, CVE-2011-2174, CVE-2011-2175, CVE-2011-2597, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0067, CVE-2012-0066)

Users of Wireshark should upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-1590, CVE-2011-4102, CVE-2012-1595)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1143, CVE-2011-1957, CVE-2011-1958, CVE-2011-1959, CVE-2011-2174, CVE-2011-2175, CVE-2011-2597, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0067, CVE-2012-0066)

Users of Wireshark should upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.

This update of wireshark fixes the following vulnerabilities :

  - Wireshark IKE dissector vulnerability. (CVE-2011-3266)

  - Wireshark Lua script execution vulnerability.
    (CVE-2011-3360)

  - Wireshark buffer exception handling vulnerability.
    (CVE-2011-3483)

  - Lucent/Ascend file parser susceptible to infinite loop.
    (CVE-2011-2597)

  - ANSI MAP dissector susceptible to infinite loop.
    (CVE-2011-2698)

  - Large/infinite loop in the DICOM dissector.
    (CVE-2011-1957)

  - A corrupted snoop file could crash Wireshark.
    (CVE-2011-1959)

  - Malformed compressed capture data could crash Wireshark.
    (CVE-2011-2174)

  - A corrupted Visual Networks file could crash Wireshark.
    (CVE-2011-2175)

  - dereferene a NULL pointer if we had a corrupted Diameter     dictionary. (CVE-2011-1958)

The remote host is affected by the vulnerability described in GLSA-201110-02 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send specially crafted packets on a network       being monitored by Wireshark, entice a user to open a malformed packet       trace file using Wireshark, or deploy a specially crafted Lua script for       use by Wireshark, possibly resulting in the execution of arbitrary code,       or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Huzaifa Sidhpurwala, David Maciejak and others discovered several vulnerabilities in the X.509if and DICOM dissectors and in the code to process various capture and dictionary files, which could lead to denial of service or the execution of arbitrary code.

Upgrade to latest release, fixing few security bugs. See http://www.wireshark.org/docs/relnotes/wireshark-1.2.17.html.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upgrade to latest release, fixing few security bugs. See http://www.wireshark.org/docs/relnotes/wireshark-1.4.7.html.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Wireshark is 1.2.x less than 1.2.17 or 1.4.x less than 1.4.7.  As such, it is affected by the following vulnerabilities :
  - An error exists in DICOM dissector that can allow denial     of service attacks when processing certain malformed     packets. (Issue #5876)

  - An error exists in the handling of corrupted snoop     files that can cause application crashes. (Issue #5912)

  - An error exists in the handling of compressed capture     data that can cause application crashes. (Issue #5908)

  - An error exists in the handling of 'Visual Networks'     files that can cause application crashes. (Issue #5934)

  - An error exists in the 'desegment_tcp()' function in the     file 'epan/dissectors/packet-tcp.c' that can allow a NULL     pointer to be dereferenced when handling certain TCP     segments. (Issue #5837)

  - An error exists in the handling of corrupted 'Diameter'     dictionary files that can cause application crashes.     (CVE-2011-1958)

This advisory updates wireshark to the latest version (1.2.17), fixing several security issues :

  - Large/infinite loop in the DICOM dissector. (Bug 5876)     Versions affected: 1.2.0 to 1.2.16 and 1.4.0 to 1.4.6.

  - Huzaifa Sidhpurwala of the Red Hat Security Response     Team discovered that a corrupted Diameter dictionary     file could crash Wireshark. Versions affected: 1.2.0 to     1.2.16 and 1.4.0 to 1.4.6.

  - Huzaifa Sidhpurwala of the Red Hat Security Response     Team discovered that a corrupted snoop file could crash     Wireshark. (Bug 5912) Versions affected: 1.2.0 to 1.2.16     and 1.4.0 to 1.4.6.

  - David Maciejak of Fortinet's FortiGuard Labs discovered     that malformed compressed capture data could crash     Wireshark. (Bug 5908) Versions affected: 1.2.0 to 1.2.16     and 1.4.0 to 1.4.6.

  - Huzaifa Sidhpurwala of the Red Hat Security Response     Team discovered that a corrupted Visual Networks file     could crash Wireshark. (Bug 5934) Versions affected:
    1.2.0 to 1.2.16 and 1.4.0 to 1.4.6.

ID	Name	Product	Family	Severity
199506	RHEL 4 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
76045	openSUSE Security Update : wireshark (openSUSE-SU-2011:1142-1)	Nessus	SuSE Local Security Checks	high
75774	openSUSE Security Update : wireshark (openSUSE-SU-2011:1142-1)	Nessus	SuSE Local Security Checks	high
68696	Oracle Linux 5 : wireshark (ELSA-2013-0125)	Nessus	Oracle Linux Local Security Checks	high
68516	Oracle Linux 6 : wireshark (ELSA-2012-0509)	Nessus	Oracle Linux Local Security Checks	high
63606	Scientific Linux Security Update : wireshark on SL5.x i386/x86_64 (20130108)	Nessus	Scientific Linux Local Security Checks	medium
63570	CentOS 5 : wireshark (CESA-2013:0125)	Nessus	CentOS Local Security Checks	medium
63408	RHEL 5 : wireshark (RHSA-2013:0125)	Nessus	Red Hat Local Security Checks	high
61303	Scientific Linux Security Update : wireshark on SL6.x i386/x86_64 (20120423)	Nessus	Scientific Linux Local Security Checks	medium
58849	CentOS 6 : wireshark (CESA-2012:0509)	Nessus	CentOS Local Security Checks	medium
58841	RHEL 6 : wireshark (RHSA-2012:0509)	Nessus	Red Hat Local Security Checks	medium
57263	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7796)	Nessus	SuSE Local Security Checks	high
57136	SuSE 11.1 Security Update : wireshark (SAT Patch Number 5281)	Nessus	SuSE Local Security Checks	high
56617	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7795)	Nessus	SuSE Local Security Checks	high
56426	GLSA-201110-02 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
55537	Debian DSA-2274-1 : wireshark - several vulnerabilities	Nessus	Debian Local Security Checks	medium
55152	Fedora 13 : wireshark-1.2.17-1.fc13 (2011-7858)	Nessus	Fedora Local Security Checks	medium
55151	Fedora 14 : wireshark-1.4.7-1.fc14 (2011-7846)	Nessus	Fedora Local Security Checks	medium
55008	Fedora 15 : wireshark-1.4.7-1.fc15 (2011-7821)	Nessus	Fedora Local Security Checks	medium
54942	Wireshark < 1.2.17 / 1.4.7 Multiple DoS Vulnerabilities	Nessus	Windows	medium
54940	Mandriva Linux Security Advisory : wireshark (MDVSA-2011:105)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2011-1959

high

Tenable Plugins

high

high

high

high

high

medium

medium

high

medium

medium

medium

high

high

high

critical

medium

medium

medium

medium

medium

medium