Wireshark (formerly Ethereal) 0.9.7 through 1.0.2 allows attackers to cause a denial of service (hang) via a crafted NCP packet that triggers an infinite loop.

From Red Hat Security Advisory 2008:0890 :

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-3146)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malformed dump file. (CVE-2008-1070, CVE-2008-1071, CVE-2008-1072, CVE-2008-1561, CVE-2008-1562, CVE-2008-1563, CVE-2008-3137, CVE-2008-3138, CVE-2008-3141, CVE-2008-3145, CVE-2008-3932, CVE-2008-3933, CVE-2008-3934)

Additionally, this update changes the default Pluggable Authentication Modules (PAM) configuration to always prompt for the root password before each start of Wireshark. This avoids unintentionally running Wireshark with root privileges.

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.3, and resolve these issues.

Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-3146)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malformed dump file. (CVE-2008-1070, CVE-2008-1071, CVE-2008-1072, CVE-2008-1561, CVE-2008-1562, CVE-2008-1563, CVE-2008-3137, CVE-2008-3138, CVE-2008-3141, CVE-2008-3145, CVE-2008-3932, CVE-2008-3933, CVE-2008-3934)

Additionally, this update changes the default Pluggable Authentication Modules (PAM) configuration to always prompt for the root password before each start of Wireshark. This avoids unintentionally running Wireshark with root privileges.

A number of vulnerabilities were discovered in Wireshark that could cause it to crash while processing malicious packets (CVE-2008-3146, CVE-2008-3932, CVE-2008-3933, CVE-2008-3934).

This update provides Wireshark 1.0.3, which is not vulnerable to these issues.

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-3146)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malformed dump file. (CVE-2008-1070, CVE-2008-1071, CVE-2008-1072, CVE-2008-1561, CVE-2008-1562, CVE-2008-1563, CVE-2008-3137, CVE-2008-3138, CVE-2008-3141, CVE-2008-3145, CVE-2008-3932, CVE-2008-3933, CVE-2008-3934)

Additionally, this update changes the default Pluggable Authentication Modules (PAM) configuration to always prompt for the root password before each start of Wireshark. This avoids unintentionally running Wireshark with root privileges.

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.3, and resolve these issues.

The remote host is affected by the vulnerability described in GLSA-200809-17 (Wireshark: Multiple Denials of Service)

    The following vulnerabilities were reported:
    Multiple buffer overflows in the NCP dissector (CVE-2008-3146).
    Infinite loop in the NCP dissector (CVE-2008-3932).
    Invalid read in the tvb_uncompress() function when processing zlib     compressed data (CVE-2008-3933).
    Unspecified error when processing Textronix .rf5 files     (CVE-2008-3934).
  Impact :

    A remote attacker could exploit these vulnerabilities by sending     specially crafted packets on a network being monitored by Wireshark or     by enticing a user to read a malformed packet trace file, causing a     Denial of Service.
  Workaround :

    There is no known workaround at this time.

Upgrade to upstream version 1.0.3. Detailed upstream release notes:
http://www.wireshark.org/docs/relnotes/wireshark-1.0.3.html Security issues addressed in the new upstream version:
http://www.wireshark.org/security /wnpa-sec-2008-05.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upgrade to upstream version 1.0.3. Detailed upstream release notes:
http://www.wireshark.org/docs/relnotes/wireshark-1.0.3.html Security issues addressed in the new upstream version:
http://www.wireshark.org/security/wnpa- sec-2008-05.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
67748	Oracle Linux 3 / 4 / 5 : wireshark (ELSA-2008-0890)	Nessus	Oracle Linux Local Security Checks	critical
60479	Scientific Linux Security Update : wireshark on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
37900	Mandriva Linux Security Advisory : wireshark (MDVSA-2008:199)	Nessus	Mandriva Local Security Checks	critical
34328	RHEL 3 / 4 / 5 : wireshark (RHSA-2008:0890)	Nessus	Red Hat Local Security Checks	critical
34326	CentOS 3 / 4 / 5 : wireshark (CESA-2008:0890)	Nessus	CentOS Local Security Checks	critical
34298	GLSA-200809-17 : Wireshark: Multiple Denials of Service	Nessus	Gentoo Local Security Checks	critical
34182	Fedora 9 : wireshark-1.0.3-1.fc9 (2008-7936)	Nessus	Fedora Local Security Checks	critical
34179	Fedora 8 : wireshark-1.0.3-1.fc8 (2008-7894)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2008-3932

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical