epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (deep recursion, stack consumption, and application crash) via a packet that specifies deeply nested data.

Multiple vulnerabilities were discovered in the dissectors/parsers for DNP, RSL, LLRP, GSM A-bis OML, ASN 1 BER which could result in denial of service.

The version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.2. It is, therefore, affected by multiple vulnerabilities in the following components, which can result in a memory disclosure, a denial of service, or the execution of arbitrary code :

  - 3GPP TS 32.423 Trace file parser
  - ASN.1 BER dissector
  - DNP dissector
  - GSM A-bis OML dissector
  - HiQnet dissector
  - HTTP/2 dissector
  - IEEE 802.11 dissector
  - iSeries file parser
  - Ixia IxVeriWave file parser
  - LBMC dissector
  - LLRP dissector
  - NFS dissector
  - RSL dissector
  - SPICE dissector
  - X.509AF dissector

Additionally, a flaw related to how dynamic-link library (DLL) files are located and loaded exists in the ui/qt/wireshark_application.cpp file due to the application using a DLL search path that may include directories that are not trusted or under the user's control. A local attacker can exploit this issue, via a crafted DLL file injected into the search path, to execute arbitrary code with the privileges of the user running the application.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Wireshark development team reports :

The following vulnerabilities have been fixed :

- wnpa-sec-2016-02

ASN.1 BER dissector crash. (Bug 11828) CVE-2016-2522

- wnpa-sec-2016-03

DNP dissector infinite loop. (Bug 11938) CVE-2016-2523

- wnpa-sec-2016-04

X.509AF dissector crash. (Bug 12002) CVE-2016-2524

- wnpa-sec-2016-05

HTTP/2 dissector crash. (Bug 12077) CVE-2016-2525

- wnpa-sec-2016-06

HiQnet dissector crash. (Bug 11983) CVE-2016-2526

- wnpa-sec-2016-07

3GPP TS 32.423 Trace file parser crash. (Bug 11982)

CVE-2016-2527

- wnpa-sec-2016-08

LBMC dissector crash. (Bug 11984) CVE-2016-2528

- wnpa-sec-2016-09

iSeries file parser crash. (Bug 11985) CVE-2016-2529

- wnpa-sec-2016-10

RSL dissector crash. (Bug 11829) CVE-2016-2530 CVE-2016-2531

- wnpa-sec-2016-11

LLRP dissector crash. (Bug 12048) CVE-2016-2532

- wnpa-sec-2016-12

Ixia IxVeriWave file parser crash. (Bug 11795)

- wnpa-sec-2016-13

IEEE 802.11 dissector crash. (Bug 11818)

- wnpa-sec-2016-14

GSM A-bis OML dissector crash. (Bug 11825)

- wnpa-sec-2016-15

ASN.1 BER dissector crash. (Bug 12106)

- wnpa-sec-2016-16

SPICE dissector large loop. (Bug 12151)

- wnpa-sec-2016-17

NFS dissector crash.

- wnpa-sec-2016-18

ASN.1 BER dissector crash. (Bug 11822)

ID	Name	Product	Family	Severity
89878	Debian DSA-3516-1 : wireshark - security update	Nessus	Debian Local Security Checks	medium
89104	Wireshark 2.0.x < 2.0.2 Multiple Vulnerabilities	Nessus	Windows	high
89048	FreeBSD : wireshark -- multiple vulnerabilities (45117749-df55-11e5-b2bd-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-4421

medium

Tenable Plugins

medium

high

medium