The DCP ETSI dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (long loop and resource consumption) via unknown vectors.

From Red Hat Security Advisory 2008:0058 :

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. Wireshark could crash or possibly execute arbitrary code as the user running Wireshark if it read a malformed packet off the network. (CVE-2007-6112, CVE-2007-6114, CVE-2007-6115, CVE-2007-6117)

Several denial of service bugs were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off the network. (CVE-2007-6111, CVE-2007-6113, CVE-2007-6116, CVE-2007-6118, CVE-2007-6119, CVE-2007-6120, CVE-2007-6121, CVE-2007-6438, CVE-2007-6439, CVE-2007-6441, CVE-2007-6450, CVE-2007-6451)

As well, Wireshark switched from using net-snmp to libsmi, which is included in this errata.

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 0.99.7, and resolve these issues.

Several flaws were found in Wireshark. Wireshark could crash or possibly execute arbitrary code as the user running Wireshark if it read a malformed packet off the network. (CVE-2007-6112, CVE-2007-6114, CVE-2007-6115, CVE-2007-6117)

Several denial of service bugs were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3392, CVE-2007-3393, CVE-2007-6111, CVE-2007-6113, CVE-2007-6116, CVE-2007-6118, CVE-2007-6119, CVE-2007-6120, CVE-2007-6121, CVE-2007-6438, CVE-2007-6439, CVE-2007-6441, CVE-2007-6450, CVE-2007-6451)

As well, Wireshark switched from using net-snmp to libsmi, which is included in this errata.

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. Wireshark could crash or possibly execute arbitrary code as the user running Wireshark if it read a malformed packet off the network. (CVE-2007-6112, CVE-2007-6114, CVE-2007-6115, CVE-2007-6117)

Several denial of service bugs were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off the network. (CVE-2007-6111, CVE-2007-6113, CVE-2007-6116, CVE-2007-6118, CVE-2007-6119, CVE-2007-6120, CVE-2007-6121, CVE-2007-6438, CVE-2007-6439, CVE-2007-6441, CVE-2007-6450, CVE-2007-6451)

As well, Wireshark switched from using net-snmp to libsmi, which is included in this errata.

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 0.99.7, and resolve these issues.

A number of vulnerabilities in the Wireshark program were found that could cause crashes, excessive looping, or arbitrary code execution.

This update provides Wireshark 0.99.7 which is not vulnerable to these issues.

An updated version of libsmi is also being provided, not because of security issues, but because this version of wireshark uses it instead of net-snmp for SNMP support.

Update :

This update is being reissued without libcap (kernel capabilities) support, as that is not required by the original released packages, and thus gave trouble for a number of users.

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6450     The RPL dissector could be tricked into an infinite     loop.

  - CVE-2007-6451     The CIP dissector could be tricked into excessive memory     allocation.

The remote host is affected by the vulnerability described in GLSA-200712-23 (Wireshark: Multiple vulnerabilities)

    Multiple buffer overflows and infinite loops were discovered in     multiple dissector and parser components, including those for MP3 and     NCP (CVE-2007-6111), PPP (CVE-2007-6112), DNP (CVE-2007-6113), SSL and     iSeries (OS/400) Communication traces (CVE-2007-6114), ANSI MAP     (CVE-2007-6115), Firebird/Interbase (CVE-2007-6116), HTTP     (CVE-2007-6117), MEGACO (CVE-2007-6118), DCP ETSI (CVE-2007-6119),     Bluetooth SDP (CVE-2007-6120), RPC Portmap (CVE-2007-6121), SMB     (CVE-2007-6438), IPv6 amd USB (CVE-2007-6439), WiMAX (CVE-2007-6441),     RPL (CVE-2007-6450), CIP (CVE-2007-6451). The vulnerabilities were     discovered by Stefan Esser, Beyond Security, Fabiodds, Peter Leeming,     Steve and ainsley.
  Impact :

    A remote attacker could send specially crafted packets on a network     being monitored with Wireshark or entice a user to open a specially     crafted file, possibly resulting in the execution of arbitrary code     with the privileges of the user running Wireshark (which might be the     root user), or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

upgrade to 0.99.7 fixes various security flaws.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Various flaws fixed by upgrade to 0.99.7

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
67642	Oracle Linux 4 / 5 : wireshark (ELSA-2008-0058)	Nessus	Oracle Linux Local Security Checks	critical
60350	Scientific Linux Security Update : wireshark on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
43670	CentOS 4 / 5 : wireshark (CESA-2008:0058)	Nessus	CentOS Local Security Checks	critical
36583	Mandriva Linux Security Advisory : wireshark (MDVSA-2008:001-1)	Nessus	Mandriva Local Security Checks	critical
30034	RHEL 4 / 5 : wireshark (RHSA-2008:0058)	Nessus	Red Hat Local Security Checks	critical
29840	Debian DSA-1446-1 : wireshark - several vulnerabilities	Nessus	Debian Local Security Checks	critical
29820	GLSA-200712-23 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
29766	Fedora 7 : wireshark-0.99.7-1.fc7 (2007-4690)	Nessus	Fedora Local Security Checks	critical
29760	Fedora 8 : wireshark-0.99.7-2.fc8 (2007-4590)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2007-6119

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical