The proto_tree_add_item function in Wireshark 1.6.0 through 1.6.1 and 1.4.0 through 1.4.8, when the IKEv1 protocol dissector is used, allows user-assisted remote attackers to cause a denial of service (infinite loop) via vectors involving a malformed IKE packet and many items in a tree.

The remote Solaris system is missing necessary patches to address security updates :

  - The proto_tree_add_item function in Wireshark 1.6.0     through 1.6.1 and 1.4.0 through 1.4.8, when the IKEv1     protocol dissector is used, allows user-assisted remote     attackers to cause a denial of service (infinite loop)     via vectors involving a malformed IKE packet and many     items in a tree. (CVE-2011-3266)

  - Untrusted search path vulnerability in Wireshark 1.4.x     before 1.4.9 and 1.6.x before 1.6.2 allows local users     to gain privileges via a Trojan horse Lua script in an     unspecified directory. (CVE-2011-3360)

  - The dissect_infiniband_common function in     epan/dissectors/packet-infiniband.c in the Infiniband     dissector in Wireshark 1.4.0 through 1.4.9 and 1.6.x     before 1.6.3 allows remote attackers to cause a denial     of service (NULL pointer dereference and application     crash) via a malformed packet. (CVE-2011-4101)

Wireshark version upgrade to 1.4.10 to fix various security flaws and other non-security issues.

This update of wireshark fixes the following vulnerabilities :

  - CVE-2011-3266: Wireshark IKE dissector vulnerability

  - CVE-2011-3360: Wireshark Lua script execution     vulnerability

  - CVE-2011-3483: Wireshark buffer exception handling     vulnerability

  - CVE-2011-2597: Lucent/Ascend file parser susceptible to     infinite loop

  - CVE-2011-2698: ANSI MAP dissector susceptible to     infinite loop

  - CVE-2011-1957: Large/infinite loop in the DICOM     dissector

  - CVE-2011-1959: A corrupted snoop file could crash     Wireshark

  - CVE-2011-2174: Malformed compressed capture data could     crash Wireshark

  - CVE-2011-2175: A corrupted Visual Networks file could     crash Wireshark

  - CVE-2011-1958: dereferene a NULL pointer if we had a     corrupted Diameter dictionary

This update of wireshark fixes the following vulnerabilities :

  - CVE-2011-3266: Wireshark IKE dissector vulnerability

  - CVE-2011-3360: Wireshark Lua script execution     vulnerability

  - CVE-2011-3483: Wireshark buffer exception handling     vulnerability 

  - CVE-2011-2597: Lucent/Ascend file parser susceptible to     infinite loop

  - CVE-2011-2698: ANSI MAP dissector susceptible to     infinite loop 

  - CVE-2011-1957: Large/infinite loop in the DICOM     dissector

  - CVE-2011-1959: A corrupted snoop file could crash     Wireshark

  - CVE-2011-2174: Malformed compressed capture data could     crash Wireshark

  - CVE-2011-2175: A corrupted Visual Networks file could     crash Wireshark

  - CVE-2011-1958: dereferene a NULL pointer if we had a     corrupted Diameter dictionary

This advisory updates wireshark to the latest version (1.6.2), fixing several security issues :

The proto_tree_add_item function in Wireshark 1.6.1, when the IKEv1 protocol dissector is used, allows user-assisted remote attackers to cause a denial of service (infinite loop) via vectors involving a malformed IKE packet and many items in a tree (CVE-2011-3266).

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory (CVE-2011-3360).

The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.2 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (application crash) via a malformed packet (CVE-2011-3482).

Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (application crash) via a malformed capture file that leads to an invalid root tvbuff, related to a buffer exception handling vulnerability. (CVE-2011-3483).

The unxorFrame function in epan/dissectors/packet-opensafety.c in the OpenSafety dissector in Wireshark 1.6.x before 1.6.2 does not properly validate a certain frame size, which allows remote attackers to cause a denial of service (loop and application crash) via a malformed packet (CVE-2011-3484).

The updated packages have been upgraded to the latest 1.6.x version (1.6.2) which is not vulnerable to these issues.

This is a wireshark version upgrade to 1.4.10 to fix various security flaws and other non-security issues.

This update of wireshark fixes the following vulnerabilities :

  - Wireshark IKE dissector vulnerability. (CVE-2011-3266)

  - Wireshark Lua script execution vulnerability.
    (CVE-2011-3360)

  - Wireshark buffer exception handling vulnerability.
    (CVE-2011-3483)

  - Lucent/Ascend file parser susceptible to infinite loop.
    (CVE-2011-2597)

  - ANSI MAP dissector susceptible to infinite loop.
    (CVE-2011-2698)

  - Large/infinite loop in the DICOM dissector.
    (CVE-2011-1957)

  - A corrupted snoop file could crash Wireshark.
    (CVE-2011-1959)

  - Malformed compressed capture data could crash Wireshark.
    (CVE-2011-2174)

  - A corrupted Visual Networks file could crash Wireshark.
    (CVE-2011-2175)

  - dereferene a NULL pointer if we had a corrupted Diameter     dictionary. (CVE-2011-1958)

The remote host is affected by the vulnerability described in GLSA-201110-02 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send specially crafted packets on a network       being monitored by Wireshark, entice a user to open a malformed packet       trace file using Wireshark, or deploy a specially crafted Lua script for       use by Wireshark, possibly resulting in the execution of arbitrary code,       or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update fixes several security bugs, see http://www.wireshark.org/docs/relnotes/wireshark-1.6.2.html for full details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes several security bugs, see http://www.wireshark.org/docs/relnotes/wireshark-1.4.9.html for full details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Wireshark is 1.6.x before 1.6.2.  This version is affected by the following vulnerabilities :

  - An error exists in IKE dissector that can allow denial     of service attacks when processing certain malformed     packets. (CVE-2011-3266)

  - A buffer exception handling vulnerability exists that     can allow denial of service attacks when processing     certain malformed packets. (Issue #6135)

  - It may be possible to make Wireshark execute Lua scripts     using a method similar to DLL hijacking. (Issue #6136)

  - An error exists in OpenSafety dissector that can allow     denial of service attacks when processing certain     malformed packets. (Issue #6138)

  - An error exists in CSN.1 dissector that can allow denial     of service attacks when processing certain malformed     packets. (Issue #6139)

The installed version of Wireshark is 1.4.x before 1.4.9.  This version is affected by the following vulnerabilities :

  - An error exists in IKE dissector that can allow denial     of service attacks when processing certain malformed     packets. (CVE-2011-3266)

  - A buffer exception handling vulnerability exists that     can allow denial of service attacks when processing     certain malformed packets. (Issue #6135)

  - It may be possible to make Wireshark execute Lua scripts     using a method similar to DLL hijacking. (Issue #6136)

ID	Name	Product	Family	Severity
80800	Oracle Solaris Third-Party Patch Update : wireshark (denial_of_service_vulnerability_in)	Nessus	Solaris Local Security Checks	high
76046	openSUSE Security Update : wireshark (openSUSE-SU-2011:1263-1)	Nessus	SuSE Local Security Checks	medium
76045	openSUSE Security Update : wireshark (openSUSE-SU-2011:1142-1)	Nessus	SuSE Local Security Checks	high
75775	openSUSE Security Update : wireshark (openSUSE-SU-2011:1263-1)	Nessus	SuSE Local Security Checks	medium
75774	openSUSE Security Update : wireshark (openSUSE-SU-2011:1142-1)	Nessus	SuSE Local Security Checks	high
61928	Mandriva Linux Security Advisory : wireshark (MDVSA-2011:138)	Nessus	Mandriva Local Security Checks	high
57264	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7839)	Nessus	SuSE Local Security Checks	medium
57263	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7796)	Nessus	SuSE Local Security Checks	high
57137	SuSE 11.1 Security Update : wireshark (SAT Patch Number 5433)	Nessus	SuSE Local Security Checks	medium
57136	SuSE 11.1 Security Update : wireshark (SAT Patch Number 5281)	Nessus	SuSE Local Security Checks	high
56617	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7795)	Nessus	SuSE Local Security Checks	high
56426	GLSA-201110-02 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
56354	Fedora 16 : wireshark-1.6.2-1.fc16 (2011-12399)	Nessus	Fedora Local Security Checks	low
56233	Fedora 14 : wireshark-1.4.9-1.fc14 (2011-12423)	Nessus	Fedora Local Security Checks	low
56225	Fedora 15 : wireshark-1.4.9-1.fc15 (2011-12403)	Nessus	Fedora Local Security Checks	low
56164	Wireshark 1.6.x < 1.6.2 Multiple Vulnerabilities	Nessus	Windows	medium
56163	Wireshark 1.4.x < 1.4.9 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2011-3266

high

Tenable Plugins

high

medium

high

medium

high

high

medium

high

medium

high

high

critical

low

low

low

medium

medium