The dissect_hsrp function in epan/dissectors/packet-hsrp.c in the HSRP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.

The remote Solaris system is missing necessary patches to address security updates :

  - The dissect_drda function in     epan/dissectors/packet-drda.c in Wireshark 1.6.x through     1.6.10 and 1.8.x through 1.8.2 allows remote attackers     to cause a denial of service (infinite loop and CPU     consumption) via a small value for a certain length     field in a capture file. (CVE-2012-3548)

  - The dissect_hsrp function in     epan/dissectors/packet-hsrp.c in the HSRP dissector in     Wireshark 1.8.x before 1.8.3 allows remote attackers to     cause a denial of service (infinite loop) via a     malformed packet. (CVE-2012-5237)

  - epan/dissectors/packet-ppp.c in the PPP dissector in     Wireshark 1.8.x before 1.8.3 uses incorrect OUI data     structures during the decoding of (1) PPP and (2) LCP     data, which allows remote attackers to cause a denial of     service (assertion failure and application exit) via a     malformed packet. (CVE-2012-5238)

  - Buffer overflow in the dissect_tlv function in     epan/dissectors/packet-ldp.c in the LDP dissector in     Wireshark 1.8.x before 1.8.3 allows remote attackers to     cause a denial of service (application crash) or     possibly have unspecified other impact via a malformed     packet. (CVE-2012-5240)

Wireshark reports :

The HSRP dissector could go into an infinite loop.

The PPP dissector could abort.

Martin Wilck discovered an infinite loop in the DRDA dissector.

Laurent Butti discovered a buffer overflow in the LDP dissector.

The installed version of Wireshark 1.8 is earlier than 1.8.3.  It thus is affected by the following vulnerabilities :

  - A malformed packet can cause the 'DRDA' and 'HSRP'     dissectors to enter an infinite loop, thereby consuming     excessive CPU resources. (CVE-2012-3548, CVE-2012-5237)

  - A malformed packet can cause the 'PPP' dissector to     crash the application. (CVE-2012-5238)

  - A malformed packet can trigger a buffer overflow in the     'LDP' dissector, which results in an application crash.
    (CVE-2012-5240)

ID	Name	Product	Family	Severity
80805	Oracle Solaris Third-Party Patch Update : wireshark (multiple_vulnerabilities_in_wireshark4)	Nessus	Solaris Local Security Checks	medium
62649	FreeBSD : Wireshark -- Multiple Vulnerabilities (a7706414-1be7-11e2-9aad-902b343deec9)	Nessus	FreeBSD Local Security Checks	medium
62478	Wireshark 1.8.x < 1.8.3 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2012-5237

high

Tenable Plugins

medium

medium

medium