Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet, related to epan/to_str.c.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Wireshark: Dos due to integer overflow in IPTrace capture format parser (CVE-2012-0067)

  - Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows user-assisted remote attackers to cause a     denial of service (NULL pointer dereference and application crash) via a crafted Diameter dictionary file.
    (CVE-2011-1958)

  - The snoop_read function in wiretap/snoop.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 does     not properly handle certain virtualizable buffers, which allows remote attackers to cause a denial of     service (application crash) via a large length value in a snoop file that triggers a stack-based buffer     over-read. (CVE-2011-1959)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Solaris system is missing necessary patches to address security updates :

  - The dissect_packet function in epan/packet.c in     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service     (application crash) via a long packet in a capture file,     as demonstrated by an airopeek file. (CVE-2012-0041)

  - Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     does not properly perform certain string conversions,     which allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash)     via a crafted packet, related to epan/to_str.c.
    (CVE-2012-0042)

  - Buffer overflow in the reassemble_message function in     epan/dissectors/ packet-rlc.c in the RLC dissector in     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via a series of fragmented RLC packets. (CVE-2012-0043)

  - Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service     (application crash) via a long packet in a (1) Accellent     5Views (aka .5vw) file, (2) I4B trace file, or (3)     NETMON 2 capture file. (CVE-2012-0066)

  - wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and     1.6.x before 1.6.5 allows remote attackers to cause a     denial of service (application crash) via a long packet     in an AIX iptrace file. (CVE-2012-0067)

  - The lanalyzer_read function in wiretap/lanalyzer.c in     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service     (application crash) via a Novell catpure file containing     a record that is too small. (CVE-2012-0068)

This update fixes the following security issues :

  - 741187: multiple file parser vulnerabilities     (CVE-2012-0041)

  - 741188: RLC dissector buffer overflow (CVE-2012-0043)

  - 741190: NULL pointer vulnerabilities (CVE-2012-0042)

  - CVE-2012-0066: DoS due to too large buffer alloc request

  - CVE-2012-0067: DoS due to integer underflow and too     large buffer alloc. request

  - CVE-2012-0068: memory corruption due to buffer underflow

Wireshark version 1.4.11 fixes several security issues

The remote host is affected by the vulnerability described in GLSA-201308-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0125 advisory.

    - fixed CVE-2012-4285, CVE-2012-4289, CVE-2012-4291 and CVE-2012-4290       (#849521)
    - fixed various flaws: CVE-2011-1959 CVE-2011-2175 CVE-2011-1958       CVE-2011-2698 CVE-2011-4102 CVE-2012-0041 CVE-2012-0042 CVE-2012-0066       CVE-2012-0067

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0509 advisory.

    [1.2.15-2.0.1.el6_2.1]
    - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect

    [1.2.15-2.1]
    - security patches
    - Resolves: CVE-2011-1143                 CVE-2011-1590                 CVE-2011-1957                 CVE-2011-1959                 CVE-2011-2174                 CVE-2011-2175 CVE-2011-1958                 CVE-2011-2597 CVE-2011-2698                 CVE-2011-4102                 CVE-2012-0041 CVE-2012-0066 CVE-2012-0067                 CVE-2012-0042                 CVE-2012-1595

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A heap-based buffer overflow flaw was found in the way Wireshark handled Endace ERF (Extensible Record Format) capture files. If Wireshark opened a specially- crafted ERF capture file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-4102)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066, CVE-2012-0067, CVE-2012-4285, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291)

This update also fixes the following bugs :

  - When Wireshark starts with the X11 protocol being     tunneled through an SSH connection, it automatically     prepares its capture filter to omit the SSH packets. If     the SSH connection was to a link-local IPv6 address     including an interface name (for example ssh -X     [ipv6addr]%eth0), Wireshark parsed this address     erroneously, constructed an incorrect capture filter and     refused to capture packets. The 'Invalid capture filter'     message was displayed. With this update, parsing of     link-local IPv6 addresses is fixed and Wireshark     correctly prepares a capture filter to omit SSH packets     over a link-local IPv6 connection.

  - Previously, Wireshark's column editing dialog malformed     column names when they were selected. With this update,     the dialog is fixed and no longer breaks column names.

  - Previously, TShark, the console packet analyzer, did not     properly analyze the exit code of Dumpcap, Wireshark's     packet capturing back end. As a result, TShark returned     exit code 0 when Dumpcap failed to parse its     command-line arguments. In this update, TShark correctly     propagates the Dumpcap exit code and returns a non-zero     exit code when Dumpcap fails.

  - Previously, the TShark '-s' (snapshot length) option     worked only for a value greater than 68 bytes. If a     lower value was specified, TShark captured just 68 bytes     of incoming packets. With this update, the '-s' option     is fixed and sizes lower than 68 bytes work as expected.

This update also adds the following enhancement :

  - In this update, support for the 'NetDump' protocol was     added.

All running instances of Wireshark must be restarted for the update to take effect.

Updated wireshark packages that fix several security issues, three bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Wireshark, previously known as Ethereal, is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network.

A heap-based buffer overflow flaw was found in the way Wireshark handled Endace ERF (Extensible Record Format) capture files. If Wireshark opened a specially crafted ERF capture file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-4102)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066, CVE-2012-0067, CVE-2012-4285, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291)

The CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, and CVE-2011-4102 issues were discovered by Huzaifa Sidhpurwala of the Red Hat Security Response Team.

This update also fixes the following bugs :

* When Wireshark starts with the X11 protocol being tunneled through an SSH connection, it automatically prepares its capture filter to omit the SSH packets. If the SSH connection was to a link-local IPv6 address including an interface name (for example ssh -X [ipv6addr]%eth0), Wireshark parsed this address erroneously, constructed an incorrect capture filter and refused to capture packets. The 'Invalid capture filter' message was displayed. With this update, parsing of link-local IPv6 addresses is fixed and Wireshark correctly prepares a capture filter to omit SSH packets over a link-local IPv6 connection. (BZ#438473)

* Previously, Wireshark's column editing dialog malformed column names when they were selected. With this update, the dialog is fixed and no longer breaks column names. (BZ#493693)

* Previously, TShark, the console packet analyzer, did not properly analyze the exit code of Dumpcap, Wireshark's packet capturing back end. As a result, TShark returned exit code 0 when Dumpcap failed to parse its command-line arguments. In this update, TShark correctly propagates the Dumpcap exit code and returns a non-zero exit code when Dumpcap fails. (BZ#580510)

* Previously, the TShark '-s' (snapshot length) option worked only for a value greater than 68 bytes. If a lower value was specified, TShark captured just 68 bytes of incoming packets. With this update, the '-s' option is fixed and sizes lower than 68 bytes work as expected.
(BZ#580513)

This update also adds the following enhancement :

* In this update, support for the 'NetDump' protocol was added.
(BZ#484999)

All users of Wireshark are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. All running instances of Wireshark must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0125 advisory.

    Wireshark, previously known as Ethereal, is a network protocol analyzer. It     is used to capture and browse the traffic running on a computer network.

    A heap-based buffer overflow flaw was found in the way Wireshark handled     Endace ERF (Extensible Record Format) capture files. If Wireshark opened a     specially-crafted ERF capture file, it could crash or, possibly, execute     arbitrary code as the user running Wireshark. (CVE-2011-4102)

    Several denial of service flaws were found in Wireshark. Wireshark could     crash or stop responding if it read a malformed packet off a network, or     opened a malicious dump file. (CVE-2011-1958, CVE-2011-1959, CVE-2011-2175,     CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066, CVE-2012-0067,     CVE-2012-4285, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291)

    The CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, and CVE-2011-4102 issues     were discovered by Huzaifa Sidhpurwala of the Red Hat Security Response     Team.

    This update also fixes the following bugs:

    * When Wireshark starts with the X11 protocol being tunneled through an SSH     connection, it automatically prepares its capture filter to omit the SSH     packets. If the SSH connection was to a link-local IPv6 address including     an interface name (for example ssh -X [ipv6addr]%eth0), Wireshark parsed     this address erroneously, constructed an incorrect capture filter and     refused to capture packets. The Invalid capture filter message was     displayed. With this update, parsing of link-local IPv6 addresses is fixed     and Wireshark correctly prepares a capture filter to omit SSH packets over     a link-local IPv6 connection. (BZ#438473)

    * Previously, Wireshark's column editing dialog malformed column names when     they were selected. With this update, the dialog is fixed and no longer     breaks column names. (BZ#493693)

    * Previously, TShark, the console packet analyzer, did not properly analyze     the exit code of Dumpcap, Wireshark's packet capturing back end. As a     result, TShark returned exit code 0 when Dumpcap failed to parse its     command-line arguments. In this update, TShark correctly propagates the     Dumpcap exit code and returns a non-zero exit code when Dumpcap fails.
    (BZ#580510)

    * Previously, the TShark -s (snapshot length) option worked only for a     value greater than 68 bytes. If a lower value was specified, TShark     captured just 68 bytes of incoming packets. With this update, the -s     option is fixed and sizes lower than 68 bytes work as expected. (BZ#580513)

    This update also adds the following enhancement:

    * In this update, support for the NetDump protocol was added. (BZ#484999)

    All users of Wireshark are advised to upgrade to these updated packages,     which contain backported patches to correct these issues and add this     enhancement. All running instances of Wireshark must be restarted for the     update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-1590, CVE-2011-4102, CVE-2012-1595)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1143, CVE-2011-1957, CVE-2011-1958, CVE-2011-1959, CVE-2011-2174, CVE-2011-2175, CVE-2011-2597, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0067, CVE-2012-0066)

Users of Wireshark should upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-1590, CVE-2011-4102, CVE-2012-1595)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1143, CVE-2011-1957, CVE-2011-1958, CVE-2011-1959, CVE-2011-2174, CVE-2011-2175, CVE-2011-2597, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0067, CVE-2012-0066)

Users of Wireshark should upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.

This version upgrade of wireshark to 1.4.11 fixes the following security issues :

  - RLC dissector buffer overflow. (CVE-2012-0043)

  - multiple file parser vulnerabilities. (CVE-2012-0041)

  - NULL pointer vulnerabilities. (CVE-2012-0042)

  - DoS due to too large buffer alloc request.
    (CVE-2012-0066)

  - DoS due to integer underflow and too large buffer alloc.
    request. (CVE-2012-0067)

  - memory corruption due to buffer underflow Additionally,     various other non-security issues were resolved.
    (CVE-2012-0068)

Laurent Butti discovered a buffer underflow in the LANalyzer dissector of the Wireshark network traffic analyzer, which could lead to the execution of arbitrary code (CVE-2012-0068 ).

This update also addresses several bugs, which can lead to crashes of Wireshark. These are not treated as security issues, but are fixed nonetheless if security updates are scheduled: CVE-2011-3483, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066 and CVE-2012-0067.

The following vulnerabilities have been fixed. wnpa-sec-2012-01 Laurent Butti discovered that Wireshark failed to properly record sizes for many packet capture file formats.

wnpa-sec-2012-02 Wireshark could dereference a NULL pointer and crash

wnpa-sec-2012-03 The RLC dissector could overflow a buffer

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following vulnerabilities have been fixed.

wnpa-sec-2012-01 Laurent Butti discovered that Wireshark failed to properly record sizes for many packet capture file formats.

wnpa-sec-2012-02 Wireshark could dereference a NULL pointer and crash

wnpa-sec-2012-03 The RLC dissector could overflow a buffer

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Wireshark is 1.6.x before 1.6.5.  This version is affected by the following vulnerabilities :

  - Errors exist in the parsers for '5views', 'i4b',     'iptrace', 'netmon2' and 'novell' packets that can lead     to application crashes. (Issues #6663, 6666, 6667,     6668, 6669, 6670)

  - An unspecified error exists in the display processing     of certain packets that can lead to a NULL pointer     dereference. (Issue #6634)

  - A buffer overflow exists in the 'RLC' dissector.
    (Issue #6391)

The installed version of Wireshark is 1.4.x before 1.4.11.  This version is affected by the following vulnerabilities :

  - Errors exist in the parsers for '5views', 'i4b',     'iptrace', 'netmon2' and 'novell' packets that can lead     to application crashes. (Issues #6663, 6666, 6667,     6668, 6669, 6670)

  - An unspecified error exists in the display processing     of certain packets that can lead to a NULL pointer     dereference. (Issue #6634)

  - A buffer overflow exists in the 'RLC' dissector.
    (Issue #6391)

ID	Name	Product	Family	Severity
199506	RHEL 4 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
80801	Oracle Solaris Third-Party Patch Update : wireshark (multiple_denial_of_service_vulnerabilities2)	Nessus	Solaris Local Security Checks	medium
76047	openSUSE Security Update : wireshark (openSUSE-SU-2012:0295-1)	Nessus	SuSE Local Security Checks	medium
74551	openSUSE Security Update : wireshark (openSUSE-2012-123)	Nessus	SuSE Local Security Checks	medium
69500	GLSA-201308-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
68696	Oracle Linux 5 : wireshark (ELSA-2013-0125)	Nessus	Oracle Linux Local Security Checks	high
68516	Oracle Linux 6 : wireshark (ELSA-2012-0509)	Nessus	Oracle Linux Local Security Checks	high
63606	Scientific Linux Security Update : wireshark on SL5.x i386/x86_64 (20130108)	Nessus	Scientific Linux Local Security Checks	medium
63570	CentOS 5 : wireshark (CESA-2013:0125)	Nessus	CentOS Local Security Checks	medium
63408	RHEL 5 : wireshark (RHSA-2013:0125)	Nessus	Red Hat Local Security Checks	high
61303	Scientific Linux Security Update : wireshark on SL6.x i386/x86_64 (20120423)	Nessus	Scientific Linux Local Security Checks	medium
58849	CentOS 6 : wireshark (CESA-2012:0509)	Nessus	CentOS Local Security Checks	medium
58841	RHEL 6 : wireshark (RHSA-2012:0509)	Nessus	Red Hat Local Security Checks	medium
58117	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7943)	Nessus	SuSE Local Security Checks	medium
58115	SuSE 11.1 Security Update : wireshark (SAT Patch Number 5741)	Nessus	SuSE Local Security Checks	medium
57735	Debian DSA-2395-1 : wireshark - buffer underflow	Nessus	Debian Local Security Checks	medium
57670	Fedora 15 : wireshark-1.4.11-1.fc15 (2012-0440)	Nessus	Fedora Local Security Checks	medium
57624	Fedora 16 : wireshark-1.6.5-1.fc16 (2012-0435)	Nessus	Fedora Local Security Checks	medium
57539	Wireshark 1.6.x < 1.6.5 Multiple Vulnerabilities	Nessus	Windows	high
57538	Wireshark 1.4.x < 1.4.11 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2012-0042

high

Tenable Plugins

high

medium

medium

medium

high

high

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

high

high