The CIP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.4.15. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.4.15 advisory.

  - The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.4.x     before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of     service (divide-by-zero error and application crash) via a zero-length message. (CVE-2012-4285)

  - Integer overflow in the dissect_xtp_ecntl function in epan/dissectors/packet-xtp.c in the XTP dissector in     Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to     cause a denial of service (loop or application crash) via a large value for a span length. (CVE-2012-4288)

  - epan/dissectors/packet-afp.c in the AFP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10,     and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (loop and CPU consumption) via     a large number of ACL entries. (CVE-2012-4289)

  - Buffer overflow in epan/dissectors/packet-rtps2.c in the RTPS2 dissector in Wireshark 1.4.x before 1.4.15,     1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (CPU     consumption) via a malformed packet. (CVE-2012-4296)

  - The CIP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows     remote attackers to cause a denial of service (memory consumption) via a malformed packet. (CVE-2012-4291)

  - The dissect_stun_message function in epan/dissectors/packet-stun.c in the STUN dissector in Wireshark     1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 does not properly interact with key-     destruction behavior in a certain tree library, which allows remote attackers to cause a denial of service     (application crash) via a malformed packet. (CVE-2012-4292)

  - plugins/ethercat/packet-ecatmb.c in the EtherCAT Mailbox dissector in Wireshark 1.4.x before 1.4.15, 1.6.x     before 1.6.10, and 1.8.x before 1.8.2 does not properly handle certain integer fields, which allows remote     attackers to cause a denial of service (application exit) via a malformed packet. (CVE-2012-4293)

  - The CTDB dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows     remote attackers to cause a denial of service (loop and CPU consumption) via a malformed packet.
    (CVE-2012-4290)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Solaris system is missing necessary patches to address security updates :

  - The dissect_pft function in     epan/dissectors/packet-dcp-etsi.c in the DCP ETSI     dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before     1.6.10, and 1.8.x before 1.8.2 allows remote attackers     to cause a denial of service (divide-by-zero error and     application crash) via a zero-length message.
    (CVE-2012-4285)

  - The pcapng_read_packet_block function in     wiretap/pcapng.c in the pcap-ng file parser in Wireshark     1.8.x before 1.8.2 allows user-assisted remote attackers     to cause a denial of service (divide-by-zero error and     application crash) via a crafted pcap-ng file.
    (CVE-2012-4286)

  - epan/dissectors/packet-mongo.c in the MongoDB dissector     in Wireshark 1.8.x before 1.8.2 allows remote attackers     to cause a denial of service (loop and CPU consumption)     via a small value for a BSON document length.
    (CVE-2012-4287)

  - Integer overflow in the dissect_xtp_ecntl function in     epan/dissectors/ packet-xtp.c in the XTP dissector in     Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and     1.8.x before 1.8.2 allows remote attackers to cause a     denial of service (loop or application crash) via a     large value for a span length. (CVE-2012-4288)

  - epan/dissectors/packet-afp.c in the AFP dissector in     Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and     1.8.x before 1.8.2 allows remote attackers to cause a     denial of service (loop and CPU consumption) via a large     number of ACL entries. (CVE-2012-4289)

  - The CTDB dissector in Wireshark 1.4.x before 1.4.15,     1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows     remote attackers to cause a denial of service (loop and     CPU consumption) via a malformed packet. (CVE-2012-4290)

  - The CIP dissector in Wireshark 1.4.x before 1.4.15,     1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows     remote attackers to cause a denial of service (memory     consumption) via a malformed packet. (CVE-2012-4291)

  - The dissect_stun_message function in     epan/dissectors/packet-stun.c in the STUN dissector in     Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and     1.8.x before 1.8.2 does not properly interact with     key-destruction behavior in a certain tree library,     which allows remote attackers to cause a denial of     service (application crash) via a malformed packet.
    (CVE-2012-4292)

  - plugins/ethercat/packet-ecatmb.c in the EtherCAT Mailbox     dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before     1.6.10, and 1.8.x before 1.8.2 does not properly handle     certain integer fields, which allows remote attackers to     cause a denial of service (application exit) via a     malformed packet. (CVE-2012-4293)

  - Buffer overflow in the channelised_fill_sdh_g707_format     function in epan/ dissectors/packet-erf.c in the ERF     dissector in Wireshark 1.8.x before 1.8.2 allows remote     attackers to execute arbitrary code via a large speed     (aka rate) value. (CVE-2012-4294)

  - Array index error in the     channelised_fill_sdh_g707_format function in epan/     dissectors/packet-erf.c in the ERF dissector in     Wireshark 1.8.x before 1.8.2 might allow remote     attackers to cause a denial of service (application     crash) via a crafted speed (aka rate) value.
    (CVE-2012-4295)

  - Buffer overflow in epan/dissectors/packet-rtps2.c in the     RTPS2 dissector in Wireshark 1.4.x before 1.4.15, 1.6.x     before 1.6.10, and 1.8.x before 1.8.2 allows remote     attackers to cause a denial of service (CPU consumption)     via a malformed packet. (CVE-2012-4296)

  - Buffer overflow in the dissect_gsm_rlcmac_downlink     function in epan/dissectors/ packet-gsm_rlcmac.c in the     GSM RLC MAC dissector in Wireshark 1.6.x before 1.6.10     and 1.8.x before 1.8.2 allows remote attackers to     execute arbitrary code via a malformed packet.
    (CVE-2012-4297)

  - Integer signedness error in the     vwr_read_rec_data_ethernet function in wiretap/ vwr.c in     the Ixia IxVeriWave file parser in Wireshark 1.8.x     before 1.8.2 allows user-assisted remote attackers to     execute arbitrary code via a crafted packet-trace file     that triggers a buffer overflow. (CVE-2012-4298)

Updated wireshark packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Wireshark, previously known as Ethereal, is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network.

Two flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2013-3559, CVE-2013-4083)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2012-2392, CVE-2012-3825, CVE-2012-4285, CVE-2012-4288, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291, CVE-2012-4292, CVE-2012-5595, CVE-2012-5597, CVE-2012-5598, CVE-2012-5599, CVE-2012-5600, CVE-2012-6056, CVE-2012-6059, CVE-2012-6060, CVE-2012-6061, CVE-2012-6062, CVE-2013-3557, CVE-2013-3561, CVE-2013-4081, CVE-2013-4927, CVE-2013-4931, CVE-2013-4932, CVE-2013-4933, CVE-2013-4934, CVE-2013-4935, CVE-2013-4936, CVE-2013-5721)

The wireshark packages have been upgraded to upstream version 1.8.10, which provides a number of bug fixes and enhancements over the previous versions. For more information on the bugs fixed, enhancements included, and supported protocols introduced, refer to the Wireshark Release Notes, linked to in the References. (BZ#711024)

This update also fixes the following bugs :

* Previously, Wireshark did not parse the RECLAIM-COMPLETE opcode when inspecting traffic generated by NFSv4.1. A patch has been provided to enable the parsing of the RECLAIM_COMPLETE opcode, and Wireshark is now able to properly dissect and handle NFSv4.1 traffic. (BZ#750712)

* Prior to this update, frame arrival times in a text file were reported one hour ahead from the timestamps in the packet capture file. This resulted in various failures being reported by the dfilter-test.py test suite. To fix this bug, frame arrival timestamps have been shifted by one hour, thus fixing this bug. (BZ#832021)

* The 'tshark -D' command returned output to STDERR instead of STDOUT, which could break scripts that are parsing the 'tshark -D' output.
This bug has been fixed, and the 'tshark -D' command now writes output data to a correct standard stream. (BZ#1004636)

* Due to an array overrun, Wireshark could experience undefined program behavior or could unexpectedly terminate. With this update, proper array handling ensures Wireshark no longer crashes in the described scenario. (BZ#715560)

* Previously, the dftest and randpkt command line utilities lacked manual pages. This update adds proper manual pages for both utilities.
(BZ#659661)

In addition, this update adds the following enhancements :

* With this update, Wireshark is able to properly dissect and handle InfiniBand and GlusterFS traffic. (BZ#699636, BZ#858976)

All Wireshark users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. All running instances of Wireshark must be restarted for the update to take effect.

Wireshark was updated to 1.8.2 :

  - The DCP ETSI dissector could trigger a zero division.
    (wnpa-sec-2012-13 CVE-2012-4285)

  - The MongoDB dissector could go into a large loop.
    (wnpa-sec-2012-14 CVE-2012-4287)

  - The XTP dissector could go into an infinite loop.
    (wnpa-sec-2012-15 CVE-2012-4288)

  - The ERF dissector could overflow a buffer.
    (wnpa-sec-2012-16 CVE-2012-4294 CVE-2012-4295)

  - The AFP dissector could go into a large loop.
    (wnpa-sec-2012-17 CVE-2012-4289)

  - The RTPS2 dissector could overflow a buffer.
    (wnpa-sec-2012-18 CVE-2012-4296)

  - The GSM RLC MAC dissector could overflow a buffer.
    (wnpa-sec-2012-19 CVE-2012-4297)

  - The CIP dissector could exhaust system memory.
    (wnpa-sec-2012-20 CVE-2012-4291)

  - The STUN dissector could crash. (wnpa-sec-2012-21     CVE-2012-4292)

  - The EtherCAT Mailbox dissector could abort.
    (wnpa-sec-2012-22 CVE-2012-4293)

  - The CTDB dissector could go into a large loop.
    (wnpa-sec-2012-23 CVE-2012-4290)

  - The pcap-ng file parser could trigger a zero division.
    (wnpa-sec-2012-24 CVE-2012-4286)

  - The Ixia IxVeriWave file parser could overflow a buffer.
    (wnpa-sec-2012-25 CVE-2012-4298) Further bug fixes and     updated protocol support as listed in:
    http://www.wireshark.org/docs/relnotes/wireshark-1.8.2.h     tml

wireshark was updated to 1.4.15

  - The DCP ETSI dissector could trigger a zero division.
    (wnpa-sec-2012-13 CVE-2012-4285)

  - The XTP dissector could go into an infinite loop.
    (wnpa-sec-2012-15 CVE-2012-4288)

  - The AFP dissector could go into a large loop.
    (wnpa-sec-2012-17 CVE-2012-4289)

  - The RTPS2 dissector could overflow a buffer.
    (wnpa-sec-2012-18 CVE-2012-4296)

  - The CIP dissector could exhaust system memory.
    (wnpa-sec-2012-20 CVE-2012-4291)

  - The STUN dissector could crash. (wnpa-sec-2012-21     CVE-2012-4292)

  - The EtherCAT Mailbox dissector could abort.
    (wnpa-sec-2012-22 CVE-2012-4293)

  - The CTDB dissector could go into a large loop.
    (wnpa-sec-2012-23 CVE-2012-4290)

Further bug fixes and updated protocol support as listed in:
http://www.wireshark.org/docs/relnotes/wireshark-1.4.15.html

Two flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2013-3559, CVE-2013-4083)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2012-2392, CVE-2012-3825, CVE-2012-4285, CVE-2012-4288, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291, CVE-2012-4292, CVE-2012-5595, CVE-2012-5597, CVE-2012-5598, CVE-2012-5599, CVE-2012-5600, CVE-2012-6056, CVE-2012-6059, CVE-2012-6060, CVE-2012-6061, CVE-2012-6062, CVE-2013-3557, CVE-2013-3561, CVE-2013-4081, CVE-2013-4927, CVE-2013-4931, CVE-2013-4932, CVE-2013-4933, CVE-2013-4934, CVE-2013-4935, CVE-2013-4936, CVE-2013-5721)

The wireshark packages have been upgraded to upstream version 1.8.10, which provides a number of bug fixes and enhancements over the previous versions. For more information on the bugs fixed, enhancements included, and supported protocols introduced, refer to the Wireshark Release Notes.

This update also fixes the following bugs :

  - Previously, Wireshark did not parse the RECLAIM-COMPLETE     opcode when inspecting traffic generated by NFSv4.1. A     patch has been provided to enable the parsing of the     RECLAIM_COMPLETE opcode, and Wireshark is now able to     properly dissect and handle NFSv4.1 traffic.

  - Prior to this update, frame arrival times in a text file     were reported one hour ahead from the timestamps in the     packet capture file. This resulted in various failures     being reported by the dfilter-test.py test suite. To fix     this bug, frame arrival timestamps have been shifted by     one hour, thus fixing this bug.

  - The 'tshark -D' command returned output to STDERR     instead of STDOUT, which could break scripts that are     parsing the 'tshark -D' output. This bug has been fixed,     and the 'tshark -D' command now writes output data to a     correct standard stream.

  - Due to an array overrun, Wireshark could experience     undefined program behavior or could unexpectedly     terminate. With this update, proper array handling     ensures Wireshark no longer crashes in the described     scenario.

  - Previously, the dftest and randpkt command line     utilities lacked manual pages. This update adds proper     manual pages for both utilities.

In addition, this update adds the following enhancements :

  - With this update, Wireshark is able to properly dissect     and handle InfiniBand and GlusterFS traffic.

All running instances of Wireshark must be restarted for the update to take effect.

Two flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2013-3559 , CVE-2013-4083)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2012-2392 , CVE-2012-3825 , CVE-2012-4285 , CVE-2012-4288 , CVE-2012-4289 , CVE-2012-4290 , CVE-2012-4291 , CVE-2012-4292 , CVE-2012-5595 , CVE-2012-5597 , CVE-2012-5598 , CVE-2012-5599 , CVE-2012-5600 , CVE-2012-6056 , CVE-2012-6059 , CVE-2012-6060 , CVE-2012-6061 , CVE-2012-6062 , CVE-2013-3557 , CVE-2013-3561 , CVE-2013-4081 , CVE-2013-4927 , CVE-2013-4931 , CVE-2013-4932 , CVE-2013-4933 , CVE-2013-4934 , CVE-2013-4935 , CVE-2013-4936 , CVE-2013-5721)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1569 advisory.

    - Resolves: CVE-2013-4927                 CVE-2013-4931                 CVE-2013-4932                 CVE-2013-4933                 CVE-2013-4934                 CVE-2013-4935                 CVE-2013-3557

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201308-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0125 advisory.

    - fixed CVE-2012-4285, CVE-2012-4289, CVE-2012-4291 and CVE-2012-4290       (#849521)
    - fixed various flaws: CVE-2011-1959 CVE-2011-2175 CVE-2011-1958       CVE-2011-2698 CVE-2011-4102 CVE-2012-0041 CVE-2012-0042 CVE-2012-0066       CVE-2012-0067

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been found and corrected in wireshark :

Infinite and large loops in ANSI MAP, BACapp, Bluetooth HCI, IEEE 802.3, LTP, and R3 dissectors have been fixed. Discovered by Laurent Butti (http://www.wireshark.org/security/wnpa-sec-2012-08.html [CVE-2012-2392])

The DIAMETER dissector could try to allocate memory improperly and crash (http://www.wireshark.org/security/wnpa-sec-2012-09.html [CVE-2012-2393])

Wireshark could crash on SPARC processors due to misaligned memory.
Discovered by Klaus Heckelmann (http://www.wireshark.org/security/wnpa-sec-2012-10.html [CVE-2012-2394])

The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted packet, as demonstrated by a usbmon dump (CVE-2012-4048).

epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet (CVE-2012-4049).

The DCP ETSI dissector could trigger a zero division (CVE-2012-4285).

The XTP dissector could go into an infinite loop (CVE-2012-4288).

The AFP dissector could go into a large loop (CVE-2012-4289).

The RTPS2 dissector could overflow a buffer (CVE-2012-4296).

The GSM RLC MAC dissector could overflow a buffer (CVE-2012-4297).

The CIP dissector could exhaust system memory (CVE-2012-4291).

The STUN dissector could crash (CVE-2012-4292).

The EtherCAT Mailbox dissector could abort (CVE-2012-4293).

The CTDB dissector could go into a large loop (CVE-2012-4290).

Martin Wilck discovered an infinite loop in the DRDA dissector (CVE-2012-5239).

The USB dissector could go into an infinite loop. (wnpa-sec-2012-31)

The ISAKMP dissector could crash. (wnpa-sec-2012-35)

The iSCSI dissector could go into an infinite loop. (wnpa-sec-2012-36)

The WTP dissector could go into an infinite loop. (wnpa-sec-2012-37)

The RTCP dissector could go into an infinite loop. (wnpa-sec-2012-38)

The ICMPv6 dissector could go into an infinite loop.
(wnpa-sec-2012-40)

Infinite and large loops in the Bluetooth HCI, CSN.1, DCP-ETSI DOCSIS CM-STAUS, IEEE 802.3 Slow Protocols, MPLS, R3, RTPS, SDP, and SIP dissectors (wnpa-sec-2013-01).

The CLNP dissector could crash (wnpa-sec-2013-02).

The DTN dissector could crash (wnpa-sec-2013-03).

The MS-MMC dissector (and possibly others) could crash (wnpa-sec-2013-04).

The DTLS dissector could crash (wnpa-sec-2013-05).

The DCP-ETSI dissector could corrupt memory (wnpa-sec-2013-07).

The Wireshark dissection engine could crash (wnpa-sec-2013-08).

The NTLMSSP dissector could overflow a buffer (wnpa-sec-2013-09).

The sFlow dissector could go into an infinite loop (CVE-2012-6054).

The SCTP dissector could go into an infinite loop (CVE-2012-6056).

The MS-MMS dissector could crash (CVE-2013-2478).

The RTPS and RTPS2 dissectors could crash (CVE-2013-2480).

The Mount dissector could crash (CVE-2013-2481).

The AMPQ dissector could go into an infinite loop (CVE-2013-2482).

The ACN dissector could attempt to divide by zero (CVE-2013-2483).

The CIMD dissector could crash (CVE-2013-2484).

The FCSP dissector could go into an infinite loop (CVE-2013-2485).

The DTLS dissector could crash (CVE-2013-2488).

This advisory provides the latest version of Wireshark (1.6.14) which is not vulnerable to these issues.

wireshark was updated to 1.4.15 to fix multiple security issues.

Issues fixed :

  - fix bnc#776038(CVE-2012-4285 / CVE-2012-4288 /     CVE-2012-4289 / CVE-2012-4296 / CVE-2012-4291 /     CVE-2012-4292 / CVE-2012-4293 / CVE-2012-4290),     bnc#772738 (CVE-2012-4048 / CVE-2012-4049)(fixed     upstream)

  - Security fixes :

  - wnpa-sec-2012-13 The DCP ETSI dissector could trigger a     zero division. Reported by Laurent Butti. (Bug 7566)

  - wnpa-sec-2012-15 The XTP dissector could go into an     infinite loop. Reported by Ben Schmidt. (Bug 7571)

  - wnpa-sec-2012-17 The AFP dissector could go into a large     loop. Reported by Stefan Cornelius. (Bug 7603)

  - wnpa-sec-2012-18 The RTPS2 dissector could overflow a     buffer. Reported by Laurent Butti. (Bug 7568)

  - wnpa-sec-2012-20 The CIP dissector could exhaust system     memory. Reported y Ben Schmidt. (Bug 7570)

  - wnpa-sec-2012-21 The STUN dissector could crash.
    Reported by Laurent Butti. (Bug 7569)

  - wnpa-sec-2012-22 The EtherCAT Mailbox dissector could     abort. Reported by Laurent Butti. (Bug 7562)

  - wnpa-sec-2012-23 The CTDB dissector could go into a     large loop. Reported by Ben Schmidt. (Bug 7573)

  - Bug fixes :

  - Wireshark crashes on opening very short NFS pcap file.
    (Bug 7498)

  - Updated Protocol Support

  - AFP, Bluetooth L2CAP, CIP, CTDB, DCP ETSI, EtherCAT     Mailbox, FC Link Control LISP, NFS, RTPS2, SCTP, STUN,     XTP

A heap-based buffer overflow flaw was found in the way Wireshark handled Endace ERF (Extensible Record Format) capture files. If Wireshark opened a specially- crafted ERF capture file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-4102)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066, CVE-2012-0067, CVE-2012-4285, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291)

This update also fixes the following bugs :

  - When Wireshark starts with the X11 protocol being     tunneled through an SSH connection, it automatically     prepares its capture filter to omit the SSH packets. If     the SSH connection was to a link-local IPv6 address     including an interface name (for example ssh -X     [ipv6addr]%eth0), Wireshark parsed this address     erroneously, constructed an incorrect capture filter and     refused to capture packets. The 'Invalid capture filter'     message was displayed. With this update, parsing of     link-local IPv6 addresses is fixed and Wireshark     correctly prepares a capture filter to omit SSH packets     over a link-local IPv6 connection.

  - Previously, Wireshark's column editing dialog malformed     column names when they were selected. With this update,     the dialog is fixed and no longer breaks column names.

  - Previously, TShark, the console packet analyzer, did not     properly analyze the exit code of Dumpcap, Wireshark's     packet capturing back end. As a result, TShark returned     exit code 0 when Dumpcap failed to parse its     command-line arguments. In this update, TShark correctly     propagates the Dumpcap exit code and returns a non-zero     exit code when Dumpcap fails.

  - Previously, the TShark '-s' (snapshot length) option     worked only for a value greater than 68 bytes. If a     lower value was specified, TShark captured just 68 bytes     of incoming packets. With this update, the '-s' option     is fixed and sizes lower than 68 bytes work as expected.

This update also adds the following enhancement :

  - In this update, support for the 'NetDump' protocol was     added.

All running instances of Wireshark must be restarted for the update to take effect.

Updated wireshark packages that fix several security issues, three bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Wireshark, previously known as Ethereal, is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network.

A heap-based buffer overflow flaw was found in the way Wireshark handled Endace ERF (Extensible Record Format) capture files. If Wireshark opened a specially crafted ERF capture file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-4102)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066, CVE-2012-0067, CVE-2012-4285, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291)

The CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, and CVE-2011-4102 issues were discovered by Huzaifa Sidhpurwala of the Red Hat Security Response Team.

This update also fixes the following bugs :

* When Wireshark starts with the X11 protocol being tunneled through an SSH connection, it automatically prepares its capture filter to omit the SSH packets. If the SSH connection was to a link-local IPv6 address including an interface name (for example ssh -X [ipv6addr]%eth0), Wireshark parsed this address erroneously, constructed an incorrect capture filter and refused to capture packets. The 'Invalid capture filter' message was displayed. With this update, parsing of link-local IPv6 addresses is fixed and Wireshark correctly prepares a capture filter to omit SSH packets over a link-local IPv6 connection. (BZ#438473)

* Previously, Wireshark's column editing dialog malformed column names when they were selected. With this update, the dialog is fixed and no longer breaks column names. (BZ#493693)

* Previously, TShark, the console packet analyzer, did not properly analyze the exit code of Dumpcap, Wireshark's packet capturing back end. As a result, TShark returned exit code 0 when Dumpcap failed to parse its command-line arguments. In this update, TShark correctly propagates the Dumpcap exit code and returns a non-zero exit code when Dumpcap fails. (BZ#580510)

* Previously, the TShark '-s' (snapshot length) option worked only for a value greater than 68 bytes. If a lower value was specified, TShark captured just 68 bytes of incoming packets. With this update, the '-s' option is fixed and sizes lower than 68 bytes work as expected.
(BZ#580513)

This update also adds the following enhancement :

* In this update, support for the 'NetDump' protocol was added.
(BZ#484999)

All users of Wireshark are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. All running instances of Wireshark must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0125 advisory.

    Wireshark, previously known as Ethereal, is a network protocol analyzer. It     is used to capture and browse the traffic running on a computer network.

    A heap-based buffer overflow flaw was found in the way Wireshark handled     Endace ERF (Extensible Record Format) capture files. If Wireshark opened a     specially-crafted ERF capture file, it could crash or, possibly, execute     arbitrary code as the user running Wireshark. (CVE-2011-4102)

    Several denial of service flaws were found in Wireshark. Wireshark could     crash or stop responding if it read a malformed packet off a network, or     opened a malicious dump file. (CVE-2011-1958, CVE-2011-1959, CVE-2011-2175,     CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066, CVE-2012-0067,     CVE-2012-4285, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291)

    The CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, and CVE-2011-4102 issues     were discovered by Huzaifa Sidhpurwala of the Red Hat Security Response     Team.

    This update also fixes the following bugs:

    * When Wireshark starts with the X11 protocol being tunneled through an SSH     connection, it automatically prepares its capture filter to omit the SSH     packets. If the SSH connection was to a link-local IPv6 address including     an interface name (for example ssh -X [ipv6addr]%eth0), Wireshark parsed     this address erroneously, constructed an incorrect capture filter and     refused to capture packets. The Invalid capture filter message was     displayed. With this update, parsing of link-local IPv6 addresses is fixed     and Wireshark correctly prepares a capture filter to omit SSH packets over     a link-local IPv6 connection. (BZ#438473)

    * Previously, Wireshark's column editing dialog malformed column names when     they were selected. With this update, the dialog is fixed and no longer     breaks column names. (BZ#493693)

    * Previously, TShark, the console packet analyzer, did not properly analyze     the exit code of Dumpcap, Wireshark's packet capturing back end. As a     result, TShark returned exit code 0 when Dumpcap failed to parse its     command-line arguments. In this update, TShark correctly propagates the     Dumpcap exit code and returns a non-zero exit code when Dumpcap fails.
    (BZ#580510)

    * Previously, the TShark -s (snapshot length) option worked only for a     value greater than 68 bytes. If a lower value was specified, TShark     captured just 68 bytes of incoming packets. With this update, the -s     option is fixed and sizes lower than 68 bytes work as expected. (BZ#580513)

    This update also adds the following enhancement:

    * In this update, support for the NetDump protocol was added. (BZ#484999)

    All users of Wireshark are advised to upgrade to these updated packages,     which contain backported patches to correct these issues and add this     enhancement. All running instances of Wireshark must be restarted for the     update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

wireshark was updated to 1.4.15 to fix multiple security issues.

Issues fixed :

  - fix bnc#776038(CVE-2012-4285 / CVE-2012-4288 /     CVE-2012-4289 / CVE-2012-4296 / CVE-2012-4291 /     CVE-2012-4292 / CVE-2012-4293 / CVE-2012-4290),     bnc#772738 (CVE-2012-4048 / CVE-2012-4049)(fixed     upstream)

  - Security fixes: o wnpa-sec-2012-13 The DCP ETSI     dissector could trigger a zero division. Reported by     Laurent Butti. (Bug 7566) o wnpa-sec-2012-15 The XTP     dissector could go into an infinite loop. Reported by     Ben Schmidt. (Bug 7571) o wnpa-sec-2012-17 The AFP     dissector could go into a large loop. Reported by Stefan     Cornelius. (Bug 7603) o wnpa-sec-2012-18 The RTPS2     dissector could overflow a buffer. Reported by Laurent     Butti. (Bug 7568) o wnpa-sec-2012-20 The CIP dissector     could exhaust system memory. Reported y Ben Schmidt.
    (Bug 7570) o wnpa-sec-2012-21 The STUN dissector could     crash. Reported by Laurent Butti. (Bug 7569) o     wnpa-sec-2012-22 The EtherCAT Mailbox dissector could     abort. Reported by Laurent Butti. (Bug 7562) o     wnpa-sec-2012-23 The CTDB dissector could go into a     large loop. Reported by Ben Schmidt. (Bug 7573)

  - Bug fixes: o Wireshark crashes on opening very short NFS     pcap file. (Bug 7498)

  - Updated Protocol Support o AFP, Bluetooth L2CAP, CIP,     CTDB, DCP ETSI, EtherCAT Mailbox, FC Link Control LISP,     NFS, RTPS2, SCTP, STUN, XTP

Multiple vulnerabilities was found and corrected in Wireshark :

The DCP ETSI dissector could trigger a zero division (CVE-2012-4285).

The MongoDB dissector could go into a large loop (CVE-2012-4287).

The XTP dissector could go into an infinite loop (CVE-2012-4288).

The AFP dissector could go into a large loop (CVE-2012-4289).

The RTPS2 dissector could overflow a buffer (CVE-2012-4296).

The GSM RLC MAC dissector could overflow a buffer (CVE-2012-4297).

The CIP dissector could exhaust system memory (CVE-2012-4291).

The STUN dissector could crash (CVE-2012-4292).

The EtherCAT Mailbox dissector could abort (CVE-2012-4293).

The CTDB dissector could go into a large loop (CVE-2012-4290).

This advisory provides the latest version of Wireshark (1.6.10) which is not vulnerable to these issues.

Upgrade to wireshark 1.6.10 The following vulnerabilities have been fixed.

wnpa-sec-2012-13: The DCP ETSI dissector could trigger a zero division. wnpa-sec-2012-15: The XTP dissector could go into an infinite loop. wnpa-sec-2012-17: The AFP dissector could go into a large loop. wnpa-sec-2012-18: The RTPS2 dissector could overflow a buffer. wnpa-sec-2012-20: The CIP dissector could exhaust system memory. wnpa-sec-2012-21: The STUN dissector could crash.
wnpa-sec-2012-22: The EtherCAT Mailbox dissector could abort.
wnpa-sec-2012-23: The CTDB dissector could go into a large loop.

See http://www.wireshark.org/docs/relnotes/wireshark-1.6.10.html for details. The following vulnerabilities have been fixed.
wnpa-sec-2012-11: The PPP dissector could crash. wnpa-sec-2012-12: The NFS dissector could use excessive amounts of CPU. The following vulnerabilities have been fixed. wnpa-sec-2012-11: The PPP dissector could crash. wnpa-sec-2012-12: The NFS dissector could use excessive amounts of CPU.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Wireshark reports :

It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

The PPP dissector could crash.

The NFS dissector could use excessive amounts of CPU.

The DCP ETSI dissector could trigger a zero division.

The MongoDB dissector could go into a large loop.

The XTP dissector could go into an infinite loop.

The ERF dissector could overflow a buffer.

The AFP dissector could go into a large loop.

The RTPS2 dissector could overflow a buffer.

The GSM RLC MAC dissector could overflow a buffer.

The CIP dissector could exhaust system memory.

The STUN dissector could crash.

The EtherCAT Mailbox dissector could abort.

The CTDB dissector could go into a large loop.

The pcap-ng file parser could trigger a zero division.

The Ixia IxVeriWave file parser could overflow a buffer.

The installed version of Wireshark is 1.8.x before 1.8.2.  This version is affected by the following vulnerabilities :

  - The 'DCP ETSI' dissector and 'pcap-ng' parser can     attempt a divide by zero operation leading to an     application crash. (CVE-2012-4285, CVE-2012-4286)

  - The 'MongoDB', 'XTP', 'AFP', and 'CTDB' dissectors can     be caused to large or infinite loops. (CVE-2012-4287,     CVE-2012-4288, CVE-2012-4289, CVE-2012-4290)

  - The 'CIP' dissector can be caused to exhaust system     memory. (CVE-2012-4291)

  - The 'STUN' dissector can be caused to crash.
    (CVE-2012-4292)

  - The 'EtherCAT Mailbox' dissector can be caused to     abort. (CVE-2012-4293)

  - A buffer overflow exists related to the 'ERF', 'RTPS2'     and 'GSM RLC MAC' dissectors. (CVE-2012-4294,     CVE-2012-4295, CVE-2012-4296, CVE-2012-4297)

  - A file parsing error related to 'Ixia IxVeriWave'     processing can allow a buffer overflow. (CVE-2012-4298)

The installed version of Wireshark is 1.6.x before 1.6.10.  This version is affected by the following vulnerabilities :

  - The 'DCP ETSI' dissector can attempt a divide by zero     operation leading to an application crash.     (CVE-2012-4285)

  - The 'XTP', 'AFP', and 'CTDB' dissectors can be caused     to large or infinite loops. (CVE-2012-4288,     CVE-2012-4289, CVE-2012-4290)

  - The 'CIP' dissector can be caused to exhaust system     memory. (CVE-2012-4291)

  - The 'STUN' dissector can be caused to crash.     (CVE-2012-4292)

  - The 'EtherCAT Mailbox' dissector can be caused to     abort. (CVE-2012-4293)

  - A buffer overflow exists related to the 'RTPS2'     and 'GSM RLC MAC' dissectors. (CVE-2012-4296     CVE-2012-4297)

The installed version of Wireshark is 1.4.x before 1.4.15.  This version is affected by the following vulnerabilities :

  - The 'DCP ETSI' dissector can attempt a divide by zero     operation leading to an application crash.
    (CVE-2012-4285)

  - The 'XTP', 'AFP', and 'CTDB' dissectors can be caused     to go into large or infinite loops. (CVE-2012-4288,     CVE-2012-4289, CVE-2012-4290)

  - The 'CIP' dissector can be caused to exhaust system     memory. (CVE-2012-4291)

  - The 'STUN' dissector can be caused to crash.
    (CVE-2012-4292)

  - The 'EtherCAT Mailbox' dissector can be caused to     abort. (CVE-2012-4293)

  - A buffer overflow exists related to the 'RTPS2'     dissector. (CVE-2012-4296)

ID	Name	Product	Family	Severity
176397	Wireshark 1.4.x < 1.4.15 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high
80804	Oracle Solaris Third-Party Patch Update : wireshark (multiple_vulnerabilities_in_wireshark3)	Nessus	Solaris Local Security Checks	high
79162	CentOS 6 : wireshark (CESA-2013:1569)	Nessus	CentOS Local Security Checks	high
74732	openSUSE Security Update : wireshark (openSUSE-SU-2012:1067-1)	Nessus	SuSE Local Security Checks	high
74720	openSUSE Security Update : wireshark (openSUSE-SU-2012:1035-1)	Nessus	SuSE Local Security Checks	low
71301	Scientific Linux Security Update : wireshark on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	high
71268	Amazon Linux AMI : wireshark (ALAS-2013-251)	Nessus	Amazon Linux Local Security Checks	high
71105	Oracle Linux 6 : wireshark (ELSA-2013-1569)	Nessus	Oracle Linux Local Security Checks	high
71005	RHEL 6 : wireshark (RHSA-2013:1569)	Nessus	Red Hat Local Security Checks	high
69500	GLSA-201308-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
68696	Oracle Linux 5 : wireshark (ELSA-2013-0125)	Nessus	Oracle Linux Local Security Checks	high
66069	Mandriva Linux Security Advisory : wireshark (MDVSA-2013:055)	Nessus	Mandriva Local Security Checks	high
64231	SuSE 11.2 Security Update : wireshark (SAT Patch Number 6760)	Nessus	SuSE Local Security Checks	low
63606	Scientific Linux Security Update : wireshark on SL5.x i386/x86_64 (20130108)	Nessus	Scientific Linux Local Security Checks	medium
63570	CentOS 5 : wireshark (CESA-2013:0125)	Nessus	CentOS Local Security Checks	medium
63408	RHEL 5 : wireshark (RHSA-2013:0125)	Nessus	Red Hat Local Security Checks	high
62097	SuSE 10 Security Update : wireshark (ZYPP Patch Number 8267)	Nessus	SuSE Local Security Checks	low
61982	Mandriva Linux Security Advisory : wireshark (MDVSA-2012:134)	Nessus	Mandriva Local Security Checks	high
61688	Fedora 17 : wireshark-1.6.10-1.fc17 (2012-12091)	Nessus	Fedora Local Security Checks	high
61687	Fedora 16 : wireshark-1.6.10-1.fc16 (2012-12085)	Nessus	Fedora Local Security Checks	high
61588	FreeBSD : Wireshark -- Multiple vulnerabilities (4cdfe875-e8d6-11e1-bea0-002354ed89bc)	Nessus	FreeBSD Local Security Checks	high
61573	Wireshark 1.8.x < 1.8.2 Multiple Vulnerabilities	Nessus	Windows	high
61572	Wireshark 1.6.x < 1.6.10 Multiple Vulnerabilities	Nessus	Windows	high
61571	Wireshark 1.4.x < 1.4.15 Multiple Vulnerabilities	Nessus	Windows	low

Detections

Analytics

CVE-2012-4291

high

Tenable Plugins

high

high

high

high

low

high

high

high

high

high

high

high

low

medium

medium

high

low

high

high

high

high

high

high

low