Unspecified vulnerability in Wireshark (formerly Ethereal) 0.99.6 through 1.0.2 allows attackers to cause a denial of service (crash) via a crafted Tektronix .rf5 file.

From Red Hat Security Advisory 2008:0890 :

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-3146)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malformed dump file. (CVE-2008-1070, CVE-2008-1071, CVE-2008-1072, CVE-2008-1561, CVE-2008-1562, CVE-2008-1563, CVE-2008-3137, CVE-2008-3138, CVE-2008-3141, CVE-2008-3145, CVE-2008-3932, CVE-2008-3933, CVE-2008-3934)

Additionally, this update changes the default Pluggable Authentication Modules (PAM) configuration to always prompt for the root password before each start of Wireshark. This avoids unintentionally running Wireshark with root privileges.

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.3, and resolve these issues.

Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-3146)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malformed dump file. (CVE-2008-1070, CVE-2008-1071, CVE-2008-1072, CVE-2008-1561, CVE-2008-1562, CVE-2008-1563, CVE-2008-3137, CVE-2008-3138, CVE-2008-3141, CVE-2008-3145, CVE-2008-3932, CVE-2008-3933, CVE-2008-3934)

Additionally, this update changes the default Pluggable Authentication Modules (PAM) configuration to always prompt for the root password before each start of Wireshark. This avoids unintentionally running Wireshark with root privileges.

This update fixes problems that could crash wireshark when processing compressed data and when processing rf5 files (CVE-2008-3933, CVE-2008-3934) as well as CVE-2008-4680 (USB dissector crash), CVE-2008-4681 (Bluetooth RFCOMM dissector crash), CVE-2008-4682 (Tamos CommView dissector crash), CVE-2008-4683 (Bluetooth ACL dissector crash), CVE-2008-4684 (PRP and MATE dissector crash) and CVE-2008-4685 (Q.931 dissector crash). CVE-2008-5285 (SMTP dissector infinite loop) and an infinite loop problem in the WLCCP dissector

A number of vulnerabilities were discovered in Wireshark that could cause it to crash while processing malicious packets (CVE-2008-3146, CVE-2008-3932, CVE-2008-3933, CVE-2008-3934).

This update provides Wireshark 1.0.3, which is not vulnerable to these issues.

This update fixes problems that could crash wireshark when processing compressed data and when processing rf5 files (CVE-2008-3933, CVE-2008-3934) as well as CVE-2008-4680 (USB dissector crash), CVE-2008-4681 (Bluetooth RFCOMM dissector crash), CVE-2008-4683 (Bluetooth ACL dissector crash), CVE-2008-4684 (PRP and MATE dissector crash) and CVE-2008-4685 (Q.931 dissector crash). CVE-2008-5285 (SMTP dissector infinite loop)

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-3146)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malformed dump file. (CVE-2008-1070, CVE-2008-1071, CVE-2008-1072, CVE-2008-1561, CVE-2008-1562, CVE-2008-1563, CVE-2008-3137, CVE-2008-3138, CVE-2008-3141, CVE-2008-3145, CVE-2008-3932, CVE-2008-3933, CVE-2008-3934)

Additionally, this update changes the default Pluggable Authentication Modules (PAM) configuration to always prompt for the root password before each start of Wireshark. This avoids unintentionally running Wireshark with root privileges.

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.3, and resolve these issues.

The remote host is affected by the vulnerability described in GLSA-200809-17 (Wireshark: Multiple Denials of Service)

    The following vulnerabilities were reported:
    Multiple buffer overflows in the NCP dissector (CVE-2008-3146).
    Infinite loop in the NCP dissector (CVE-2008-3932).
    Invalid read in the tvb_uncompress() function when processing zlib     compressed data (CVE-2008-3933).
    Unspecified error when processing Textronix .rf5 files     (CVE-2008-3934).
  Impact :

    A remote attacker could exploit these vulnerabilities by sending     specially crafted packets on a network being monitored by Wireshark or     by enticing a user to read a malformed packet trace file, causing a     Denial of Service.
  Workaround :

    There is no known workaround at this time.

Upgrade to upstream version 1.0.3. Detailed upstream release notes:
http://www.wireshark.org/docs/relnotes/wireshark-1.0.3.html Security issues addressed in the new upstream version:
http://www.wireshark.org/security /wnpa-sec-2008-05.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upgrade to upstream version 1.0.3. Detailed upstream release notes:
http://www.wireshark.org/docs/relnotes/wireshark-1.0.3.html Security issues addressed in the new upstream version:
http://www.wireshark.org/security/wnpa- sec-2008-05.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
67748	Oracle Linux 3 / 4 / 5 : wireshark (ELSA-2008-0890)	Nessus	Oracle Linux Local Security Checks	critical
60479	Scientific Linux Security Update : wireshark on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
40152	openSUSE Security Update : wireshark (wireshark-387)	Nessus	SuSE Local Security Checks	medium
37900	Mandriva Linux Security Advisory : wireshark (MDVSA-2008:199)	Nessus	Mandriva Local Security Checks	critical
35272	openSUSE 10 Security Update : wireshark (wireshark-5886)	Nessus	SuSE Local Security Checks	medium
34328	RHEL 3 / 4 / 5 : wireshark (RHSA-2008:0890)	Nessus	Red Hat Local Security Checks	critical
34326	CentOS 3 / 4 / 5 : wireshark (CESA-2008:0890)	Nessus	CentOS Local Security Checks	critical
34298	GLSA-200809-17 : Wireshark: Multiple Denials of Service	Nessus	Gentoo Local Security Checks	critical
34182	Fedora 9 : wireshark-1.0.3-1.fc9 (2008-7936)	Nessus	Fedora Local Security Checks	critical
34179	Fedora 8 : wireshark-1.0.3-1.fc8 (2008-7894)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2008-3934

high

Tenable Plugins

critical

critical

medium

critical

medium

critical

critical

critical

critical

critical