Integer overflow in the dissect_osd2_cdb_continuation function in epan/dissectors/packet-scsi-osd.c in the SCSI OSD dissector in Wireshark 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.

The remote host is affected by the vulnerability described in GLSA-201510-03 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Wireshark was updated to 1.10.13 on openSUSE 13.1 to fix bugs and security issues. Wireshark was updated to 1.12.4 on openSUSE 13.2 to fix bugs and security issues.

The following security issues were fixed in 1.10.13 :

  - The WCP dissector could crash. wnpa-sec-2015-07     CVE-2015-2188 [bnc#920696]

  - The pcapng file parser could crash. wnpa-sec-2015-08     CVE-2015-2189 [bnc#920697]

  - The TNEF dissector could go into an infinite loop.
    wnpa-sec-2015-10 CVE-2015-2191 [bnc#920699]

  - Further bug fixes and updated protocol support as listed     in:
    https://www.wireshark.org/docs/relnotes/wireshark-1.10.1     3.html

The following security issues were fixed in 1.12.4 :

  - The following security issues were fixed :

  - The ATN-CPDLC dissector could crash. wnpa-sec-2015-06     CVE-2015-2187 [bnc#920695]

  - The WCP dissector could crash. wnpa-sec-2015-07     CVE-2015-2188 [bnc#920696]

  - The pcapng file parser could crash. wnpa-sec-2015-08     CVE-2015-2189 [bnc#920697]

  - The LLDP dissector could crash. wnpa-sec-2015-09     CVE-2015-2190 [bnc#920698]

  - The TNEF dissector could go into an infinite loop.
    wnpa-sec-2015-10 CVE-2015-2191 [bnc#920699]

  - The SCSI OSD dissector could go into an infinite loop.
    wnpa-sec-2015-11 CVE-2015-2192 [bnc#920700]

  - Further bug fixes and updated protocol support as listed     in:
    https://www.wireshark.org/docs/relnotes/wireshark-1.12.4     .html

The version of Wireshark installed remote Windows host is 1.10.x prior to 1.10.13, or 1.12.x prior to 1.12.4. It is, therefore, affected by denial of service vulnerabilities in the following items :

    - ATN-CPDLC dissector (CVE-2015-2187)
    - WCP dissector (CVE-2015-2188)
    - pcapng file parser (CVE-2015-2189)
    - LLDP dissector (CVE-2015-2190)
    - TNEF dissector (CVE-2015-2191)
    - SCSI OSD dissector (CVE-2015-2192)

A remote attacker can exploit these vulnerabilities to cause Wireshark to crash or consume excessive CPU resources, either by injecting a specially crafted packet onto the wire or by convincing a user to read a malformed packet trace or PCAP file.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
86688	GLSA-201510-03 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
81869	openSUSE Security Update : wireshark (openSUSE-2015-226)	Nessus	SuSE Local Security Checks	medium
81672	Wireshark 1.10.x < 1.10.13 / 1.12.x < 1.12.4 Multiple DoS Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2015-2192

high

Tenable Plugins

medium

medium

medium