wtap.c in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application abort) via a malformed Tamos CommView capture file (aka .ncf file) with an "unknown/unexpected packet type" that triggers a failed assertion.

From Red Hat Security Advisory 2009:0313 :

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malformed dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-4683, CVE-2009-0599)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malformed dump file. (CVE-2008-4680, CVE-2008-4681, CVE-2008-4682, CVE-2008-4684, CVE-2008-4685, CVE-2008-5285, CVE-2009-0600)

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.6, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.

Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malformed dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-4683, CVE-2009-0599)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malformed dump file. (CVE-2008-4680, CVE-2008-4681, CVE-2008-4682,CVE-2008-4684, CVE-2008-4685, CVE-2008-5285, CVE-2009-0600)

All running instances of Wireshark must be restarted for the update to take effect.

This update fixes problems that could crash wireshark when processing compressed data and when processing rf5 files (CVE-2008-3933, CVE-2008-3934) as well as CVE-2008-4680 (USB dissector crash), CVE-2008-4681 (Bluetooth RFCOMM dissector crash), CVE-2008-4682 (Tamos CommView dissector crash), CVE-2008-4683 (Bluetooth ACL dissector crash), CVE-2008-4684 (PRP and MATE dissector crash) and CVE-2008-4685 (Q.931 dissector crash). CVE-2008-5285 (SMTP dissector infinite loop) and an infinite loop problem in the WLCCP dissector

The remote host is affected by the vulnerability described in GLSA-200906-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark:
    David Maciejak discovered a vulnerability in packet-usb.c in the USB     dissector via a malformed USB Request Block (URB) (CVE-2008-4680).
    Florent Drouin and David Maciejak reported an unspecified vulnerability     in the Bluetooth RFCOMM dissector (CVE-2008-4681).
    A malformed Tamos CommView capture file (aka .ncf file) with an     'unknown/unexpected packet type' triggers a failed assertion in wtap.c     (CVE-2008-4682).
    An unchecked packet length parameter in the dissect_btacl() function in     packet-bthci_acl.c in the Bluetooth ACL dissector causes an erroneous     tvb_memcpy() call (CVE-2008-4683).
    A vulnerability where packet-frame does not properly handle exceptions     thrown by post dissectors caused by a certain series of packets     (CVE-2008-4684).
    Mike Davies reported a use-after-free vulnerability in the     dissect_q931_cause_ie() function in packet-q931.c in the Q.931     dissector via certain packets that trigger an exception     (CVE-2008-4685).
    The Security Vulnerability Research Team of Bkis reported that the SMTP     dissector could consume excessive amounts of CPU and memory     (CVE-2008-5285).
    The vendor reported that the WLCCP dissector could go into an infinite     loop (CVE-2008-6472).
    babi discovered a buffer overflow in wiretap/netscreen.c via a     malformed NetScreen snoop file (CVE-2009-0599).
    A specially crafted Tektronix K12 text capture file can cause an     application crash (CVE-2009-0600).
    A format string vulnerability via format string specifiers in the HOME     environment variable (CVE-2009-0601).
    THCX Labs reported a format string vulnerability in the     PROFINET/DCP (PN-DCP) dissector via a PN-DCP packet with format string     specifiers in the station name (CVE-2009-1210).
    An unspecified vulnerability with unknown impact and attack vectors     (CVE-2009-1266).
    Marty Adkins and Chris Maynard discovered a parsing error in the     dissector for the Check Point High-Availability Protocol (CPHAP)     (CVE-2009-1268).
    Magnus Homann discovered a parsing error when loading a Tektronix .rf5     file (CVE-2009-1269).
    The vendor reported that the PCNFSD dissector could crash     (CVE-2009-1829).
  Impact :

    A remote attacker could exploit these vulnerabilities by sending     specially crafted packets on a network being monitored by Wireshark or     by enticing a user to read a malformed packet trace file which can     trigger a Denial of Service (application crash or excessive CPU and     memory usage) and possibly allow for the execution of arbitrary code     with the privileges of the user running Wireshark.
  Workaround :

    There is no known workaround at this time.

A number of vulnerabilities were discovered in Wireshark that could cause it to crash or abort while processing malicious packets (CVE-2008-4680, CVE-2008-4681, CVE-2008-4682, CVE-2008-4683, CVE-2008-4684, CVE-2008-4685).

This update provides Wireshark 1.0.4, which is not vulnerable to these issues.

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malformed dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-4683, CVE-2009-0599)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malformed dump file. (CVE-2008-4680, CVE-2008-4681, CVE-2008-4682, CVE-2008-4684, CVE-2008-4685, CVE-2008-5285, CVE-2009-0600)

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.6, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.

ID	Name	Product	Family	Severity
67809	Oracle Linux 3 / 4 / 5 : wireshark (ELSA-2009-0313)	Nessus	Oracle Linux Local Security Checks	medium
60541	Scientific Linux Security Update : wireshark on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
40152	openSUSE Security Update : wireshark (wireshark-387)	Nessus	SuSE Local Security Checks	medium
39580	GLSA-200906-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
36750	Mandriva Linux Security Advisory : wireshark (MDVSA-2008:215)	Nessus	Mandriva Local Security Checks	medium
35772	RHEL 3 / 4 / 5 : wireshark (RHSA-2009:0313)	Nessus	Red Hat Local Security Checks	medium
35767	CentOS 3 / 4 : wireshark (CESA-2009:0313)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2008-4682

high

Tenable Plugins

medium

medium

medium

critical

medium

medium

medium