The APN decode functionality in (1) epan/dissectors/packet-gtp.c and (2) epan/dissectors/packet-gsm_a_gm.c in the GTP and GSM Management dissectors in Wireshark 1.10.x before 1.10.9 does not completely initialize a certain buffer, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c (CVE-2018-6836)

  - The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x     before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a     denial of service (application crash) via a crafted packet. (CVE-2014-2907)

  - The dissect_frame function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark     1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to     represent an error condition, which allows remote attackers to cause a denial of service (application     crash) via a crafted packet. (CVE-2014-4020)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Solaris system is missing necessary patches to address security updates :

  - The dissect_log function in plugins/irda/packet-irda.c     in the IrDA dissector in Wireshark 1.10.x before 1.10.9     does not properly strip '\n' characters, which allows     remote attackers to cause a denial of service (buffer     underflow and application crash) via a crafted packet.
    (CVE-2014-5161)

  - The read_new_line function in wiretap/catapult_dct2000.c     in the Catapult DCT2000 dissector in Wireshark 1.10.x     before 1.10.9 does not properly strip '\ n' and '\r'     characters, which allows remote attackers to cause a     denial of service (off-by-one buffer underflow and     application crash) via a crafted packet. (CVE-2014-5162)

  - The APN decode functionality in (1)     epan/dissectors/packet-gtp.c and (2) epan/     dissectors/packet-gsm_a_gm.c in the GTP and GSM     Management dissectors in Wireshark 1.10.x before 1.10.9     does not completely initialize a certain buffer, which     allows remote attackers to cause a denial of service     (application crash) via a crafted packet.
    (CVE-2014-5163)

  - The rlc_decode_li function in     epan/dissectors/packet-rlc.c in the RLC dissector in     Wireshark 1.10.x before 1.10.9 initializes a certain     structure member only after this member is used, which     allows remote attackers to cause a denial of service     (application crash) via a crafted packet.
    (CVE-2014-5164)

  - The dissect_ber_constrained_bitstring function in     epan/dissectors/packet-ber.c in the ASN.1 BER dissector     in Wireshark 1.10.x before 1.10.9 does not properly     validate padding values, which allows remote attackers     to cause a denial of service (buffer underflow and     application crash) via a crafted packet. (CVE-2014-5165)

Wireshark was update to 1.10.10 [bnc#897055]

On openSUSE 12.3, the package was upgraded to 1.10.x from 1.8.x as it was discontinued.

This update fixes vulnerabilities in Wireshark that could allow an attacker to crash Wireshark or make it become unresponsive by sending specific packages onto the network or have it loaded via a capture file while the dissectors are running. It also contains a number of other bug fixes.

  - RTP dissector crash wnpa-sec-2014-12 CVE-2014-6421     CVE-2014-6422

  - MEGACO dissector infinite loop wnpa-sec-2014-13     CVE-2014-6423

  - Netflow dissector crash wnpa-sec-2014-14 CVE-2014-6424

  - RTSP dissector crash wnpa-sec-2014-17 CVE-2014-6427

  - SES dissector crash wnpa-sec-2014-18 CVE-2014-6428

  - Sniffer file parser crash wnpa-sec-2014-19 CVE-2014-6429     CVE-2014-6430 CVE-2014-6431 CVE-2014-6432

  - Further bug fixes as listed in:
    https://www.wireshark.org/docs/relnotes/wireshark-1.10.1     0.html

  - includes changes from 1.10.9: fixes several crashes     triggered by malformed protocol packages

  - vulnerabilities fixed :

  - The Catapult DCT2000 and IrDA dissectors could underrun     a buffer wnpa-sec-2014-08 CVE-2014-5161 CVE-2014-5162     (bnc#889901)

  - The GSM Management dissector could crash     wnpa-sec-2014-09 CVE-2014-5163 (bnc#889906)

  - The RLC dissector could crash wnpa-sec-2014-10     CVE-2014-5164 (bnc#889900)

  - The ASN.1 BER dissector could crash wnpa-sec-2014-11     CVE-2014-5165 (bnc#889899)

  - Further bug fixes as listed in:
    https://www.wireshark.org/docs/relnotes/wireshark-1.10.9     .html

The wireshark package was upgraded to 1.10.10 from 1.8.x as 1.8 was discontinued.

This update fixes vulnerabilities that could allow an attacker to crash Wireshark or make it become unresponsive by sending specific packets onto the network or have them loaded via a capture file while the dissectors are running. It also contains a number of other bug fixes.

  - RTP dissector crash. (wnpa-sec-2014-12 CVE-2014-6421 /     CVE-2014-6422)

  - MEGACO dissector infinite loop. (wnpa-sec-2014-13     CVE-2014-6423)

  - Netflow dissector crash. (wnpa-sec-2014-14     CVE-2014-6424)

  - RTSP dissector crash. (wnpa-sec-2014-17 CVE-2014-6427)

  - SES dissector crash. (wnpa-sec-2014-18 CVE-2014-6428)

  - Sniffer file parser crash. (wnpa-sec-2014-19     CVE-2014-6429 / CVE-2014-6430 / CVE-2014-6431 /     CVE-2014-6432)

  - The Catapult DCT2000 and IrDA dissectors could underrun     a buffer. (wnpa-sec-2014-08 CVE-2014-5161 /     CVE-2014-5162, bnc#889901)

  - The GSM Management dissector could crash.
    (wnpa-sec-2014-09 CVE-2014-5163, bnc#889906)

  - The RLC dissector could crash. (wnpa-sec-2014-10     CVE-2014-5164, bnc#889900)

  - The ASN.1 BER dissector could crash. (wnpa-sec-2014-11     CVE-2014-5165, bnc#889899) Further bug fixes as listed     in:
    https://www.wireshark.org/docs/relnotes/wireshark-1.10.1     0.html and     https://www.wireshark.org/docs/relnotes/wireshark-1.10.9     .html .

The remote host is affected by the vulnerability described in GLSA-201409-01 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker can cause a Denial of Service condition via specially       crafted packets.
  Workaround :

    There is no known workaround at this time.

This wireshark version update to 1.10.9 fixes the following security issues :

  - fixes several crashes triggered by malformed protocol     packages

  - The Catapult DCT2000 and IrDA dissectors could underrun     a buffer wnpa-sec-2014-08 CVE-2014-5161 CVE-2014-5162     (bnc#889901)

  - The GSM Management dissector could crash     wnpa-sec-2014-09 CVE-2014-5163 (bnc#889906)

  - The RLC dissector could crash wnpa-sec-2014-10     CVE-2014-5164 (bnc#889900)

  - The ASN.1 BER dissector could crash wnpa-sec-2014-11     CVE-2014-5165 (bnc#889899)

  - Further bug fixes as listed in:
    https://www.wireshark.org/docs/relnotes/wireshark-1.10.9     .html

Multiple vulnerabilities were discovered in the dissectors for Catapult DCT2000, IrDA, GSM Management, RLC ASN.1 BER, which could result in denial of service.

Multiple vulnerabilities has been discovered and corrected in wireshark :

  - The Catapult DCT2000 and IrDA dissectors could underrun     a buffer (CVE-2014-5161, CVE-2014-5162).

  - The GTP and GSM Management dissectors could crash     (CVE-2014-5163).

  - The RLC dissector could crash (CVE-2014-5164).

  - The ASN.1 BER dissector could crash (CVE-2014-5165).

The updated packages have been upgraded to the 1.10.9 version where these security flaws has been fixed.

Ver. 1.10.9; Security fix for CVE-2014-5164, CVE-2014-5165, CVE-2014-5163, CVE-2014-5161, CVE-2014-5162

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Wireshark is version 1.10.x prior to 1.10.9.
It is, therefore, affected by the following vulnerabilities :

  - A buffer underflow flaw exists in the 'dissect_log'     function of the IrDA dissector, which is triggered when     handling malformed packets. Using a specially crafted     packet, a remote attacker could cause a denial of     service by crashing the application. (CVE-2014-5161)

  - A buffer underflow flaw exists in the 'read_new_line'     function of the DCT2000 dissector, which is triggered     when handling malformed packets. Using a specially     crafted packet, a remote attacker could cause a denial     of service by crashing the application. (CVE-2014-5162)

  - An APN decode flaw exists in the GTP and GSM Management     dissectors, which is triggered when handling malformed     packets. Using a specially crafted packet, a remote     attacker could cause a denial of service by crashing the     application. (CVE-2014-5163)

  - An initialization flaw exists in the 'rlc_decode_li'     function of the RLC dissector, which is triggered when     handling malformed packets. Using a specially crafted     packet, a remote attacker could cause a denial of     service by crashing the application. (CVE-2014-5164)

  - A padding validation flaw exists within the ASN.1 BER     dissector, which is triggered when handling malformed     packets. Using a specially crafted packet, a remote     attacker could cause a denial of service by crashing     the application. (CVE-2014-5165)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199503	RHEL 7 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
80815	Oracle Solaris Third-Party Patch Update : wireshark (multiple_buffer_errors_vulnerabilities_in3)	Nessus	Solaris Local Security Checks	medium
78021	openSUSE Security Update : wireshark (openSUSE-SU-2014:1249-1)	Nessus	SuSE Local Security Checks	medium
77960	SuSE 11.3 Security Update : wireshark (SAT Patch Number 9745)	Nessus	SuSE Local Security Checks	medium
77470	GLSA-201409-01 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
77288	openSUSE Security Update : wireshark (openSUSE-SU-2014:1038-1)	Nessus	SuSE Local Security Checks	medium
77111	Debian DSA-3002-1 : wireshark - security update	Nessus	Debian Local Security Checks	medium
77098	Mandriva Linux Security Advisory : wireshark (MDVSA-2014:159)	Nessus	Mandriva Local Security Checks	medium
77072	Fedora 20 : wireshark-1.10.9-1.fc20 (2014-9112)	Nessus	Fedora Local Security Checks	medium
76992	Wireshark 1.10.x < 1.10.9 Multiple DoS Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2014-5163

high

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium