Wireshark 開発チームによる報告：

以下の脆弱性は修正済みです：

- wnpa-sec-2016-41

PacketBB のクラッシュ。（バグ 12577）

- wnpa-sec-2016-42

WSP の無限ループ。（バグ 12594）

- wnpa-sec-2016-44

RLC の長いループ。（バグ 12660）

- wnpa-sec-2016-45

LDSS ディセクタのクラッシュ。（バグ 12662）

- wnpa-sec-2016-46

RLC ディセクタのクラッシュ。（バグ 12664）

- wnpa-sec-2016-47

OpenFlow の長いループ。（バグ 12659）

- wnpa-sec-2016-48

MMSE、WAP、WBXML、および WSP の無限ループ。（バグ 12661）

- wnpa-sec-2016-49

WBXML のクラッシュ。（バグ 12663）

遠端 Windows 主機上安裝的 Wireshark 版本為 2.0.5 之前的 2.0.x 版。因此受到多個拒絕服務弱點影響：

- CORBA IDL 解剖器中存在一個拒絕服務弱點，這是因為不當處理封包所導致。未經驗證的遠端攻擊者可惡意利用此問題，透過特製封包或封包追蹤檔案來造成應用程式損毀。請注意，此弱點僅影響 Windows 的 64 位元版本。(CVE-2016-6503)

- 存在一個拒絕服務弱點，此弱點是因 packet-packetbb.c 中 dissect_pbb_tlvblock() 函式的一個除以零瑕疵所導致。未經驗證的遠端攻擊者可惡意利用此問題，透過特製封包或封包追蹤檔案來造成應用程式損毀。(CVE-2016-6505)

- packet_wsp.c 中的 add_headers() 函式存在一個瑕疵，wkh_content_disposition() 函式傳回零位移時會觸發此瑕疵。未經驗證的遠端攻擊者可惡意利用此瑕疵，透過特製封包或封包追蹤檔案來造成無限迴圈，進而導致拒絕服務情形。(CVE-2016-6506)

- 存在一個拒絕服務弱點，此弱點是因 packet-rlc.c 的 rlc_decode_li() 函式中使用的一個錯誤整數資料類型所導致。未經驗證的遠端攻擊者可惡意利用此弱點，透過特製封包或封包追蹤檔案，造成長迴圈和過度消耗 CPU 資源，進而導致拒絕服務情形。(CVE-2016-6508)

- packet-ldss.c 中的 dissect_ldss_transfer() 函式存在一個拒絕服務弱點，重新建立已存在的對話時會觸發此弱點。未經驗證的遠端攻擊者可惡意利用此問題，透過特製封包或封包追蹤檔案來造成應用程式損毀。(CVE-2016-6509)

- packet-rlc.c 中的 rlc_decode_li() 函式存在一個溢位情形，此情形是因不當驗證使用者提供的輸入所導致。未經驗證的遠端攻擊者可惡意利用此問題，透過特製封包或封包追蹤檔案來造成堆疊型緩衝區溢位，進而導致拒絕服務情形。
 (CVE-2016-6510)

- proto.c 中的 proto_tree_add_text_valist_internal() 函式存在一個拒絕服務弱點，此弱點是因不當處理封包所導致。未經驗證的遠端攻擊者可惡意利用此弱點，透過特製封包或封包追蹤檔案，造成長迴圈和過度消耗 CPU 資源。
 (CVE-2016-6511)

- MMSE、WAP、WBXML 和 WSP 解剖器中存在多個瑕疵，這是因為不當處理封包所導致。未經驗證的遠端攻擊者可惡意利用這些問題，透過特製封包或封包追蹤檔案來造成無限迴圈，進而導致拒絕服務。(CVE-2016-6512)

- packet-wbxml.c 中的 parse_wbxml_tag_defined() 函式存在一個拒絕服務弱點，這是因為不當處理封包所導致。未經驗證的遠端攻擊者可惡意利用此問題，透過特製封包或封包追蹤檔案來造成應用程式損毀。(CVE-2016-6513)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

远程 Windows 主机上安装的 Wireshark 2.0.x 版低于 2.0.5。因此，它受到多种拒绝服务漏洞的影响：

- 由于未正确处理数据包，CORBA IDL 分析器中存在一个拒绝服务漏洞。未经认证的远程攻击者可利用此问题，通过特别构建的数据包或数据包跟踪文件来造成应用程序崩溃。请注意，此漏洞仅影响 Windows 的 64 位版本。(CVE-2016-6503)

- 存在一个拒绝服务漏洞，这是因为 packet-packetbb.c 的 dissect_pbb_tlvblock() 函数中的一个除以零缺陷所导致。未经认证的远程攻击者可利用此问题，通过特别构建的数据包或数据包跟踪文件来造成应用程序崩溃。(CVE-2016-6505)

- packet_wsp.c 的 add_headers() 函数中存在一个缺陷，wkh_content_disposition() 函数返回零偏移时会触发此缺陷。未经认证的远程攻击者可利用此缺陷，通过特别构建的数据包或数据包跟踪文件来造成无限循环，从而导致拒绝服务情况。(CVE-2016-6506)

- 存在一个拒绝服务漏洞，这是因为 packet-rlc.c 的 rlc_decode_li() 函数中使用了一个错误的整数数据类型所导致。未经认证的远程攻击者可利用此漏洞，通过特别构建的数据包或数据包跟踪文件，造成长循环和过度消耗 CPU 资源，从而导致拒绝服务情况。(CVE-2016-6508)

- packet-ldss.c 的 dissect_ldss_transfer() 函数中存在一个拒绝服务漏洞，重新创建已存在的对话时会触发此漏洞。未经认证的远程攻击者可利用此问题，通过特别构建的数据包或数据包跟踪文件来造成应用程序崩溃。(CVE-2016-6509)

- packet-rlc.c 的 rlc_decode_li() 函数中存在一个溢出情况，这是因为不当验证用户提供的输入所导致。未经认证的远程攻击者可利用此问题，通过特别构建的数据包或数据包跟踪文件来造成基于堆栈的缓冲区溢出，从而导致拒绝服务情况。
 (CVE-2016-6510)

- proto.c 的 proto_tree_add_text_valist_internal() 函数中存在一个拒绝服务漏洞，这是因为不当处理数据包所导致。未经认证的远程攻击者可利用此漏洞，通过特别构建的数据包或数据包跟踪文件，造成长循环和过度消耗 CPU 资源。
 (CVE-2016-6511)

- 由于未正确处理数据包，MMSE、WAP、WBXML 和 WSP 分析器中存在多个缺陷。未经认证的远程攻击者可利用这些缺陷，通过特别构建的数据包或数据包跟踪文件来造成无限循环，从而导致拒绝服务情况。(CVE-2016-6512)

- 由于未正确处理数据包，packet-wbxml.c 中的 parse_wbxml_tag_defined() 函数存在一个拒绝服务漏洞。未经认证的远程攻击者可利用此问题，通过特别构建的数据包或数据包跟踪文件来造成应用程序崩溃。(CVE-2016-6513)

请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号。

リモートのWindowsホストにインストールされているWiresharkのバージョンは、2.0.5より前の2.0.xです。このため、複数のサービス拒否脆弱性の影響を受けます。

  - パケットが不適切に処理されているため、CORBA IDL ディセクタにサービス拒否の脆弱性が存在します。認証されていないリモートの攻撃者がこれを悪用して、特別に細工されたパケットまたはパケットトレースファイルを通じて、アプリケーションをクラッシュさせる可能性があります。Note that this vulnerability only affects 64-bit versions of Windows. (CVE-2016-6503)

  - packet-packetbb.c の dissect_pbb_tlvblock() 関数にあるゼロ除算の欠陥により、サービス拒否の脆弱性が存在します。An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace file, to cause an application crash. (CVE-2016-6505)

  - packet_wsp.c の add_headers() 関数に欠陥が存在します。これは、ゼロのオフセットが wkh_content_disposition() 関数により返されたときに発生します。An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace file, to cause an infinite loop, resulting in a denial of service condition. (CVE-2016-6506)

  - packet-rlc.c の rlc_decode_li() 関数が使用する整数データタイプが不適切なため、サービス拒否の脆弱性が存在します。An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace file, to cause a long loop and excessive CPU resource consumption, resulting in a denial of service condition. (CVE-2016-6508)

  - packet-ldss.c の dissect_ldss_transfer() 関数でサービス拒否の脆弱性が存在します。これはすでに存在する対話を再度作成する際に発生します。An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace file, to cause an application crash. (CVE-2016-6509)

  - packet-rlc.c の rlc_decode_li() 関数に、ユーザー指定入力の不適切な検証に起因するオーバーフロー状態が存在します。認証されていないリモートの攻撃者がこれを悪用して、特別に細工されたパケットまたはパケットトレースファイルを通じて、スタックベースのバッファオーバーフローを発生させ、結果としてサービス拒否状態を引き起す可能性があります。
    (CVE-2016-6510)

  - パケットが不適切に処理されているため、proto.c の proto_tree_add_text_valist_internal() 関数にサービス拒否の脆弱性が存在します。認証されていないリモートの攻撃者がこれを悪用して、特別に細工されたパケットまたはパケットトレースファイルを通じて、無限ループと過剰な CPU リソース消費を発生させる可能性があります。
    (CVE-2016-6511)

  - パケットが不適切に処理されているため、MMSE、WAP、WBXML、WSP のディセクタに複数の欠陥が存在します。An unauthenticated, remote attacker can exploit these issues, via a specially crafted packet or packet trace file, to cause an infinite loop, resulting in a denial of service condition. (CVE-2016-6512)

  - パケットが不適切に処理されているため、packet-wbxml.c の parse_wbxml_tag_defined() 関数にサービス拒否の脆弱性が存在します。An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace file, to cause an application crash. (CVE-2016-6513)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

Wireshark 开发团队报告：

已修复以下漏洞：

- wnpa-sec-2016-41

PacketBB 崩溃。（缺陷 12577）

- wnpa-sec-2016-42

WSP 无限循环。（缺陷 12594）

- wnpa-sec-2016-44

RLC 长循环。（缺陷 12660）

- wnpa-sec-2016-45

LDSS 分析器崩溃。（缺陷 12662）

- wnpa-sec-2016-46

RLC 分析器崩溃。（缺陷 12664）

- wnpa-sec-2016-47

OpenFlow 长循环。（缺陷 12659）

- wnpa-sec-2016-48

MMSE、WAP、WBXML 和 WSP 无限循环。（缺陷 12661）

- wnpa-sec-2016-49

WBXML 崩溃。（缺陷 12663）

Wireshark 開發團隊報告：

已修正下列弱點：

- wnpa-sec-2016-41

PacketBB 損毀。(錯誤 12577)

- wnpa-sec-2016-42

WSP 無限迴圈。(錯誤 12594)

- wnpa-sec-2016-44

RLC 長迴圈。(錯誤 12660)

- wnpa-sec-2016-45

LDSS 解剖器損毀。(錯誤 12662)

- wnpa-sec-2016-46

RLC 解剖器損毀。(錯誤 12664)

- wnpa-sec-2016-47

OpenFlow 長迴圈。(錯誤 12659)

- wnpa-sec-2016-48

MMSE、WAP、WBXML 和 WSP 無限迴圈。(錯誤 12661)

- wnpa-sec-2016-49

WBXML 損毀。(錯誤 12663)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c (CVE-2018-6836)

  - Stack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x     through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of service (infinite     loop) via vectors involving self-referential ASN.1 CHOICE values. (CVE-2011-1142)

  - Multiple integer overflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers     to cause a denial of service (infinite loop) via vectors related to the (1) BACapp and (2) Bluetooth HCI     dissectors, a different vulnerability than CVE-2012-2392. (CVE-2012-3825)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c (CVE-2018-6836)

  - Stack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x     through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of service (infinite     loop) via vectors involving self-referential ASN.1 CHOICE values. (CVE-2011-1142)

  - The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table     searches for empty strings, which allows remote attackers to cause a denial of service (application crash)     via a crafted packet, related to the (1) dissector_get_string_handle and (2)     dissector_get_default_string_handle functions. (CVE-2015-6243)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c (CVE-2018-6836)

  - The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x     before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a     denial of service (application crash) via a crafted packet. (CVE-2014-2907)

  - The dissect_frame function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark     1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to     represent an error condition, which allows remote attackers to cause a denial of service (application     crash) via a crafted packet. (CVE-2014-4020)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Wireshark development team reports :

The following vulnerabilities have been fixed :

- wnpa-sec-2016-41

PacketBB crash. (Bug 12577)

- wnpa-sec-2016-42

WSP infinite loop. (Bug 12594)

- wnpa-sec-2016-44

RLC long loop. (Bug 12660)

- wnpa-sec-2016-45

LDSS dissector crash. (Bug 12662)

- wnpa-sec-2016-46

RLC dissector crash. (Bug 12664)

- wnpa-sec-2016-47

OpenFlow long loop. (Bug 12659)

- wnpa-sec-2016-48

MMSE, WAP, WBXML, and WSP infinite loop. (Bug 12661)

- wnpa-sec-2016-49

WBXML crash. (Bug 12663)

The version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.5. It is, therefore, affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists in the CORBA     IDL dissector due to improper handling of packets. An     unauthenticated, remote attacker can exploit this, via a     specially crafted packet or packet trace file, to cause     an application crash. Note that this vulnerability only     affects 64-bit versions of Windows. (CVE-2016-6503)

  - A denial of service vulnerability exists due to a     divide-by-zero flaw in the dissect_pbb_tlvblock()     function in packet-packetbb.c. An unauthenticated,     remote attacker can exploit this, via a specially     crafted packet or packet trace file, to cause an     application crash. (CVE-2016-6505)

  - A flaw exists in the add_headers() function in     packet_wsp.c that is triggered when an offset of zero is     returned by the wkh_content_disposition() function. An     unauthenticated, remote attacker can exploit this, via a     specially crafted packet or packet trace file, to cause     an infinite loop, resulting in a denial of service     condition. (CVE-2016-6506)

  - A denial of service vulnerability exists due to an     incorrect integer data type used in the rlc_decode_li()     function in packet-rlc.c. An unauthenticated, remote     attacker can exploit this, via a specially crafted     packet or packet trace file, to cause a long loop and     excessive CPU resource consumption, resulting in a     denial of service condition. (CVE-2016-6508)

  - A denial of service vulnerability exists in the     dissect_ldss_transfer() function in packet-ldss.c that     is triggered when recreating a conversation that already     exists. An unauthenticated, remote attacker can exploit     this, via a specially crafted packet or packet trace     file, to cause an application crash. (CVE-2016-6509)

  - An overflow condition exists in the rlc_decode_li()     function in packet-rlc.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this, via a specially crafted packet or     packet trace file, to cause a stack-based buffer     overflow, resulting in a denial of service condition.
    (CVE-2016-6510)

  - A denial of service vulnerability exists in the     proto_tree_add_text_valist_internal() function in     proto.c due to improper handling of packets. An     unauthenticated, remote attacker can exploit this, via a     specially crafted packet or packet trace file, to cause     a long loop and excessive CPU resource consumption.
    (CVE-2016-6511)

  - Multiple flaws exist in the MMSE, WAP, WBXML, and WSP     dissectors due to improper handling of packets. An     unauthenticated, remote attacker can exploit these     issues, via a specially crafted packet or packet trace     file, to cause an infinite loop, resulting in a denial     of service condition. (CVE-2016-6512)

  - A denial of service vulnerability exists in the     parse_wbxml_tag_defined() function in packet-wbxml.c due     to improper handling of packets. An unauthenticated,     remote attacker can exploit this, via a specially     crafted packet or packet trace file, to cause an     application crash. (CVE-2016-6513)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
92771	FreeBSD：wireshark -- 複数の脆弱性（610101ea-5b6a-11e6-b334-002590263bf5）	Nessus	FreeBSD Local Security Checks	8/8/2016	1/4/2021	medium
92817	Wireshark 2.0.x < 2.0.5 多個 DoS	Nessus	Windows	8/9/2016	3/9/2023	medium
92817	Wireshark 2.0.x < 2.0.5 多种 DoS	Nessus	Windows	8/9/2016	3/9/2023	medium
92817	Wireshark 2.0.x < 2.0.5の複数のDoS	Nessus	Windows	8/9/2016	3/9/2023	medium
92771	FreeBSD：wireshark -- 多种漏洞 (610101ea-5b6a-11e6-b334-002590263bf5)	Nessus	FreeBSD Local Security Checks	8/8/2016	1/4/2021	medium
92771	FreeBSD：wireshark -- 多個弱點 (610101ea-5b6a-11e6-b334-002590263bf5)	Nessus	FreeBSD Local Security Checks	8/8/2016	1/4/2021	medium
199535	RHEL 5 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
199531	RHEL 6 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
199503	RHEL 7 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
92771	FreeBSD : wireshark -- multiple vulnerabilities (610101ea-5b6a-11e6-b334-002590263bf5)	Nessus	FreeBSD Local Security Checks	8/8/2016	1/4/2021	medium
92817	Wireshark 2.0.x < 2.0.5 Multiple DoS	Nessus	Windows	8/9/2016	3/9/2023	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

critical

critical

critical

medium

medium