In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the ASTERIX dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-asterix.c by changing a data type to avoid an integer overflow.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c (CVE-2018-6836)

  - Multiple integer overflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers     to cause a denial of service (infinite loop) via vectors related to the (1) BACapp and (2) Bluetooth HCI     dissectors, a different vulnerability than CVE-2012-2392. (CVE-2012-3825)

  - The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark     1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and     application crash) via a crafted packet. (CVE-2014-8710)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c (CVE-2018-6836)

  - The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table     searches for empty strings, which allows remote attackers to cause a denial of service (application crash)     via a crafted packet, related to the (1) dissector_get_string_handle and (2)     dissector_get_default_string_handle functions. (CVE-2015-6243)

  - The dissect_zbee_secure function in epan/dissectors/packet-zbee-security.c in the ZigBee dissector in     Wireshark 1.12.x before 1.12.7 improperly relies on length fields contained in packet data, which allows     remote attackers to cause a denial of service (application crash) via a crafted packet. (CVE-2015-6244)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c (CVE-2018-6836)

  - The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x     before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a     denial of service (application crash) via a crafted packet. (CVE-2014-2907)

  - The dissect_frame function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark     1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to     represent an error condition, which allows remote attackers to cause a denial of service (application     crash) via a crafted packet. (CVE-2014-4020)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

Wireshark was updated to version 2.2.6, which brings several new features, enhancements and bug fixes. Thses security issues were fixed :

  - CVE-2017-7700: In Wireshark the NetScaler file parser     could go into an infinite loop, triggered by a malformed     capture file. This was addressed in wiretap/netscaler.c     by ensuring a nonzero record size (bsc#1033936)

  - CVE-2017-7701: In Wireshark the BGP dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-bgp.c by using a different     integer data type (bsc#1033937)

  - CVE-2017-7702: In Wireshark the WBXML dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-wbxml.c by adding length     validation (bsc#1033938)

  - CVE-2017-7703: In Wireshark the IMAP dissector could     crash, triggered by packet injection or a malformed     capture file. This was addressed in     epan/dissectors/packet-imap.c by calculating a line's     end correctly (bsc#1033939)

  - CVE-2017-7704: In Wireshark the DOF dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-dof.c by using a different     integer data type and adjusting a return value     (bsc#1033940)

  - CVE-2017-7705: In Wireshark the RPC over RDMA dissector     could go into an infinite loop, triggered by packet     injection or a malformed capture file. This was     addressed in epan/dissectors/packet-rpcrdma.c by     correctly checking for going beyond the maximum offset     (bsc#1033941)

  - CVE-2017-7745: In Wireshark the SIGCOMP dissector could     go into an infinite loop, triggered by packet injection     or a malformed capture file. This was addressed in     epan/dissectors/packet-sigcomp.c by correcting a     memory-size check (bsc#1033942)

  - CVE-2017-7746: In Wireshark the SLSK dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-slsk.c by adding checks for the     remaining length (bsc#1033943)

  - CVE-2017-7747: In Wireshark the PacketBB dissector could     crash, triggered by packet injection or a malformed     capture file. This was addressed in     epan/dissectors/packet-packetbb.c by restricting     additions to the protocol tree (bsc#1033944)

  - CVE-2017-7748: In Wireshark the WSP dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-wsp.c by adding a length check     (bsc#1033945)

  - CVE-2017-6014: In Wireshark a crafted or malformed     STANAG 4607 capture file will cause an infinite loop and     memory exhaustion. If the packet size field in a packet     header is null, the offset to read from will not     advance, causing continuous attempts to read the same     zero length packet. This will quickly exhaust all system     memory (bsc#1025913)

  - CVE-2017-5596: In Wireshark the ASTERIX dissector could     go into an infinite loop, triggered by packet injection     or a malformed capture file. This was addressed in     epan/dissectors/packet-asterix.c by changing a data type     to avoid an integer overflow (bsc#1021739)

  - CVE-2017-5597: In Wireshark the DHCPv6 dissector could     go into a large loop, triggered by packet injection or a     malformed capture file. This was addressed in     epan/dissectors/packet-dhcpv6.c by changing a data type     to avoid an integer overflow (bsc#1021739)

  - CVE-2016-9376: In Wireshark the OpenFlow dissector could     crash with memory exhaustion, triggered by network     traffic or a capture file. This was addressed in     epan/dissectors/packet-openflow_v5.c by ensuring that     certain length values were sufficiently large     (bsc#1010735)

  - CVE-2016-9375: In Wireshark the DTN dissector could go     into an infinite loop, triggered by network traffic or a     capture file. This was addressed in     epan/dissectors/packet-dtn.c by checking whether SDNV     evaluation was successful (bsc#1010740)

  - CVE-2016-9374: In Wireshark the AllJoyn dissector could     crash with a buffer over-read, triggered by network     traffic or a capture file. This was addressed in     epan/dissectors/packet-alljoyn.c by ensuring that a     length variable properly tracked the state of a     signature variable (bsc#1010752)

  - CVE-2016-9373: In Wireshark the DCERPC dissector could     crash with a use-after-free, triggered by network     traffic or a capture file. This was addressed in     epan/dissectors/packet-dcerpc-nt.c and     epan/dissectors/packet-dcerpc-spoolss.c by using the     wmem file scope for private strings (bsc#1010754)

  - CVE-2016-7180: epan/dissectors/packet-ipmi-trace.c in     the IPMI trace dissector in Wireshark did not properly     consider whether a string is constant, which allowed     remote attackers to cause a denial of service     (use-after-free and application crash) via a crafted     packet (bsc#998800)

  - CVE-2016-7179: Stack-based buffer overflow in     epan/dissectors/packet-catapult-dct2000.c in the     Catapult DCT2000 dissector in Wireshark allowed remote     attackers to cause a denial of service (application     crash) via a crafted packet (bsc#998963)

  - CVE-2016-7178: epan/dissectors/packet-umts_fp.c in the     UMTS FP dissector in Wireshark did not ensure that     memory is allocated for certain data structures, which     allowed remote attackers to cause a denial of service     (invalid write access and application crash) via a     crafted packet (bsc#998964)

  - CVE-2016-7177: epan/dissectors/packet-catapult-dct2000.c     in the Catapult DCT2000 dissector in Wireshark did not     restrict the number of channels, which allowed remote     attackers to cause a denial of service (buffer over-read     and application crash) via a crafted packet (bsc#998763)

  - CVE-2016-7176: epan/dissectors/packet-h225.c in the     H.225 dissector in Wireshark called snprintf with one of     its input buffers as the output buffer, which allowed     remote attackers to cause a denial of service (copy     overlap and application crash) via a crafted packet     (bsc#998762)

  - CVE-2016-7175: epan/dissectors/packet-qnet6.c in the     QNX6 QNET dissector in Wireshark mishandled MAC address     data, which allowed remote attackers to cause a denial     of service (out-of-bounds read and application crash)     via a crafted packet (bsc#998761)

  - CVE-2016-6354: Heap-based buffer overflow in the     yy_get_next_buffer function in Flex might have allowed     context-dependent attackers to cause a denial of service     or possibly execute arbitrary code via vectors involving     num_to_read (bsc#990856).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Wireshark was updated to version 2.0.12, which brings several new features, enhancements and bug fixes. These security issues were fixed :

  - CVE-2017-7700: In Wireshark the NetScaler file parser     could go into an infinite loop, triggered by a malformed     capture file. This was addressed in wiretap/netscaler.c     by ensuring a nonzero record size (bsc#1033936).

  - CVE-2017-7701: In Wireshark the BGP dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-bgp.c by using a different     integer data type (bsc#1033937).

  - CVE-2017-7702: In Wireshark the WBXML dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-wbxml.c by adding length     validation (bsc#1033938).

  - CVE-2017-7703: In Wireshark the IMAP dissector could     crash, triggered by packet injection or a malformed     capture file. This was addressed in     epan/dissectors/packet-imap.c by calculating a line's     end correctly (bsc#1033939).

  - CVE-2017-7704: In Wireshark the DOF dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-dof.c by using a different     integer data type and adjusting a return value     (bsc#1033940).

  - CVE-2017-7705: In Wireshark the RPC over RDMA dissector     could go into an infinite loop, triggered by packet     injection or a malformed capture file. This was     addressed in epan/dissectors/packet-rpcrdma.c by     correctly checking for going beyond the maximum offset     (bsc#1033941).

  - CVE-2017-7745: In Wireshark the SIGCOMP dissector could     go into an infinite loop, triggered by packet injection     or a malformed capture file. This was addressed in     epan/dissectors/packet-sigcomp.c by correcting a     memory-size check (bsc#1033942).

  - CVE-2017-7746: In Wireshark the SLSK dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-slsk.c by adding checks for the     remaining length (bsc#1033943).

  - CVE-2017-7747: In Wireshark the PacketBB dissector could     crash, triggered by packet injection or a malformed     capture file. This was addressed in     epan/dissectors/packet-packetbb.c by restricting     additions to the protocol tree (bsc#1033944).

  - CVE-2017-7748: In Wireshark the WSP dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-wsp.c by adding a length check     (bsc#1033945).

  - CVE-2016-7179: Stack-based buffer overflow in     epan/dissectors/packet-catapult-dct2000.c in the     Catapult DCT2000 dissector in Wireshark allowed remote     attackers to cause a denial of service (application     crash) via a crafted packet (bsc#998963).

  - CVE-2016-9376: In Wireshark the OpenFlow dissector could     crash with memory exhaustion, triggered by network     traffic or a capture file. This was addressed in     epan/dissectors/packet-openflow_v5.c by ensuring that     certain length values were sufficiently large     (bsc#1010735).

  - CVE-2016-9375: In Wireshark the DTN dissector could go     into an infinite loop, triggered by network traffic or a     capture file. This was addressed in     epan/dissectors/packet-dtn.c by checking whether SDNV     evaluation was successful (bsc#1010740).

  - CVE-2016-9374: In Wireshark the AllJoyn dissector could     crash with a buffer over-read, triggered by network     traffic or a capture file. This was addressed in     epan/dissectors/packet-alljoyn.c by ensuring that a     length variable properly tracked the state of a     signature variable (bsc#1010752).

  - CVE-2016-9373: In Wireshark the DCERPC dissector could     crash with a use-after-free, triggered by network     traffic or a capture file. This was addressed in     epan/dissectors/packet-dcerpc-nt.c and     epan/dissectors/packet-dcerpc-spoolss.c by using the     wmem file scope for private strings (bsc#1010754).

  - CVE-2016-7175: epan/dissectors/packet-qnet6.c in the     QNX6 QNET dissector in Wireshark mishandled MAC address     data, which allowed remote attackers to cause a denial     of service (out-of-bounds read and application crash)     via a crafted packet (bsc#998761).

  - CVE-2016-7176: epan/dissectors/packet-h225.c in the     H.225 dissector in Wireshark called snprintf with one of     its input buffers as the output buffer, which allowed     remote attackers to cause a denial of service (copy     overlap and application crash) via a crafted packet     (bsc#998762).

  - CVE-2016-7177: epan/dissectors/packet-catapult-dct2000.c     in the Catapult DCT2000 dissector in Wireshark did not     restrict the number of channels, which allowed remote     attackers to cause a denial of service (buffer over-read     and application crash) via a crafted packet     (bsc#998763).

  - CVE-2016-7180: epan/dissectors/packet-ipmi-trace.c in     the IPMI trace dissector in Wireshark did not properly     consider whether a string is constant, which allowed     remote attackers to cause a denial of service     (use-after-free and application crash) via a crafted     packet (bsc#998800).

  - CVE-2016-7178: epan/dissectors/packet-umts_fp.c in the     UMTS FP dissector in Wireshark did not ensure that     memory is allocated for certain data structures, which     allowed remote attackers to cause a denial of service     (invalid write access and application crash) via a     crafted packet (bsc#998964).

  - CVE-2017-6014: In Wireshark a crafted or malformed     STANAG 4607 capture file will cause an infinite loop and     memory exhaustion. If the packet size field in a packet     header is null, the offset to read from will not     advance, causing continuous attempts to read the same     zero length packet. This will quickly exhaust all system     memory (bsc#1025913).

  - CVE-2017-5596: In Wireshark the ASTERIX dissector could     go into an infinite loop, triggered by packet injection     or a malformed capture file. This was addressed in     epan/dissectors/packet-asterix.c by changing a data type     to avoid an integer overflow (bsc#1021739).

  - CVE-2017-5597: In Wireshark the DHCPv6 dissector could     go into a large loop, triggered by packet injection or a     malformed capture file. This was addressed in     epan/dissectors/packet-dhcpv6.c by changing a data type     to avoid an integer overflow (bsc#1021739).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that wireshark, a network protocol analyzer, contained several vulnerabilities in the dissectors for ASTERIX, DHCPv6, NetScaler, LDSS, IAX2, WSP, K12 and STANAG 4607, that could lead to various crashes, denial-of-service or execution of arbitrary code.

It was discovered that Wireshark, a network protocol analyzer, contained several vulnerabilities in the dissectors for ASTERIX, DHCPv6, LDSS, IAX2, WSP and RTMPT and the NetScaler and K12 file parsers, that could lead to various crashes, denial of service, or execution of arbitrary code.

For Debian 7 'Wheezy', these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u6~deb7u7.

We recommend that you upgrade your wireshark packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to Wireshark 2.2.4 fixes two minor vulnerabilities that could be used to cause Wireshark to go into a large or infinite loop by sending specially crafted packages over the network or into a capture file. (bsc#1021739)

  - CVE-2017-5596: The ASTERIX dissector could go into an     infinite loop (wnpa-sec-2017-01)

  - CVE-2017-5597: The DHCPv6 dissector could go into a     large loop (wnpa-sec-2017-02)

  - Further bug fixes and updated protocol support as listed     in:
    https://www.wireshark.org/docs/relnotes/wireshark-2.2.4.
    html

The version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.10 or 2.2.x prior to 2.2.4. It is, therefore, affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists when handling     DHCPv6 packets due to an integer overflow condition in     file epan/dissectors/packet-dhcpv6.c. An     unauthenticated, remote attacker can exploit this to     cause the program to enter a large loop that consumes     excessive CPU resources (CVE-2017-5597).

  - A denial of service vulnerability exists in the     asterix_fspec_len() function within file     epan/dissectors/packet-asterix.c due to an infinite loop     flaw that is triggered because certain input is     improperly validated. An unauthenticated, remote     attacker can exploit this to consume excessive CPU     resources (CVE-2017-5596).

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199535	RHEL 5 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199531	RHEL 6 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199503	RHEL 7 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196731	RHEL 6 : wireshark (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196702	RHEL 5 : wireshark (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
100539	SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2017:1442-1)	Nessus	SuSE Local Security Checks	critical
99991	SUSE SLES11 Security Update : wireshark (SUSE-SU-2017:1174-1)	Nessus	SuSE Local Security Checks	high
97800	Debian DSA-3811-1 : wireshark - security update	Nessus	Debian Local Security Checks	high
97782	Debian DLA-858-1 : wireshark security update	Nessus	Debian Local Security Checks	high
97167	Fedora 25 : wireshark (2017-541aea2890)	Nessus	Fedora Local Security Checks	high
96997	openSUSE Security Update : Wireshark (openSUSE-2017-194)	Nessus	SuSE Local Security Checks	high
96765	Wireshark 2.0.x < 2.0.10 / 2.2.x < 2.2.4 Multiple DoS	Nessus	Windows	high

Detections

Analytics

CVE-2017-5596

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high