The Check Point High-Availability Protocol (CPHAP) dissector in Wireshark 0.9.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted FWHA_MY_STATE packet.

From Red Hat Security Advisory 2009:1100 :

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

A format string flaw was found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-1210)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-1268, CVE-2009-1269, CVE-2009-1829)

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.8, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.

A format string flaw was found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-1210)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-1268, CVE-2009-1269, CVE-2009-1829)

All running instances of Wireshark must be restarted for the update to take effect.

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2560     A NULL pointer dereference was found in the RADIUS     dissector.

  - CVE-2009-3550     A NULL pointer dereference was found in the DCERP/NT     dissector.

  - CVE-2009-3829     An integer overflow was discovered in the ERF parser.

This update also includes fixes for three minor issues (CVE-2008-1829, CVE-2009-2562, CVE-2009-3241 ), which were scheduled for the next stable point update. Also CVE-2009-1268 was fixed for Etch. Since this security update was issued prior to the release of the point update, the fixes were included.

Version upgrade to Wireshark 1.0.7 to fix various vulnerabilities :

  - crash while loading a Tektronix .rf5 file CVE-2009-1268:
    crash in Check Point High-Availability Protocol (CPHAP)     dissector CVE-2009-1267: LDAP dissector could crash on     Windows CVE-2009-1210: PROFINET format string bug     CVE-2009-1266: additional PROFINET format string bugs, a     crash in the PCNFSD dissector. (CVE-2009-1269)

Version upgrade to Wireshark 1.0.7 to fix various vulnerabilities :

  - crash while loading a Tektronix .rf5 file.
    (CVE-2009-1269)

  - crash in Check Point High-Availability Protocol (CPHAP)     dissector. (CVE-2009-1268)

  - LDAP dissector could crash on Windows. (CVE-2009-1267)

  - PROFINET format string bug. (CVE-2009-1210)

  - additional PROFINET format string bugs, a crash in the     PCNFSD dissector. (CVE-2009-1266)

Version upgrade to Wireshark 1.0.7 to fix various vulnerabilities:
CVE-2009-1269: crash while loading a Tektronix .rf5 file CVE-2009-1268: crash in Check Point High-Availability Protocol (CPHAP) dissector CVE-2009-1267: LDAP dissector could crash on Windows CVE-2009-1210: PROFINET format string bug CVE-2009-1266: additional PROFINET format string bugs, a crash in the PCNFSD dissector

The remote host is affected by the vulnerability described in GLSA-200906-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark:
    David Maciejak discovered a vulnerability in packet-usb.c in the USB     dissector via a malformed USB Request Block (URB) (CVE-2008-4680).
    Florent Drouin and David Maciejak reported an unspecified vulnerability     in the Bluetooth RFCOMM dissector (CVE-2008-4681).
    A malformed Tamos CommView capture file (aka .ncf file) with an     'unknown/unexpected packet type' triggers a failed assertion in wtap.c     (CVE-2008-4682).
    An unchecked packet length parameter in the dissect_btacl() function in     packet-bthci_acl.c in the Bluetooth ACL dissector causes an erroneous     tvb_memcpy() call (CVE-2008-4683).
    A vulnerability where packet-frame does not properly handle exceptions     thrown by post dissectors caused by a certain series of packets     (CVE-2008-4684).
    Mike Davies reported a use-after-free vulnerability in the     dissect_q931_cause_ie() function in packet-q931.c in the Q.931     dissector via certain packets that trigger an exception     (CVE-2008-4685).
    The Security Vulnerability Research Team of Bkis reported that the SMTP     dissector could consume excessive amounts of CPU and memory     (CVE-2008-5285).
    The vendor reported that the WLCCP dissector could go into an infinite     loop (CVE-2008-6472).
    babi discovered a buffer overflow in wiretap/netscreen.c via a     malformed NetScreen snoop file (CVE-2009-0599).
    A specially crafted Tektronix K12 text capture file can cause an     application crash (CVE-2009-0600).
    A format string vulnerability via format string specifiers in the HOME     environment variable (CVE-2009-0601).
    THCX Labs reported a format string vulnerability in the     PROFINET/DCP (PN-DCP) dissector via a PN-DCP packet with format string     specifiers in the station name (CVE-2009-1210).
    An unspecified vulnerability with unknown impact and attack vectors     (CVE-2009-1266).
    Marty Adkins and Chris Maynard discovered a parsing error in the     dissector for the Check Point High-Availability Protocol (CPHAP)     (CVE-2009-1268).
    Magnus Homann discovered a parsing error when loading a Tektronix .rf5     file (CVE-2009-1269).
    The vendor reported that the PCNFSD dissector could crash     (CVE-2009-1829).
  Impact :

    A remote attacker could exploit these vulnerabilities by sending     specially crafted packets on a network being monitored by Wireshark or     by enticing a user to read a malformed packet trace file which can     trigger a Denial of Service (application crash or excessive CPU and     memory usage) and possibly allow for the execution of arbitrary code     with the privileges of the user running Wireshark.
  Workaround :

    There is no known workaround at this time.

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

A format string flaw was found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-1210)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-1268, CVE-2009-1269, CVE-2009-1829)

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.8, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.

Update to 1.0.8 fixes various security flaws.
http://www.wireshark.org/security/wnpa-sec-2009-03.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upgrade to 1.0.8 fixes various security flaws.
http://www.wireshark.org/security/wnpa-sec-2009-02.html http://www.wireshark.org/security/wnpa-sec-2009-03.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

upgrade to wireshark-1.0.7 fixes various security flaws.
http://www.wireshark.org/security/wnpa-sec-2009-02.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Wireshark team reports :

Wireshark 1.0.7 fixes the following vulnerabilities :

- The PROFINET dissector was vulnerable to a format string overflow.
(Bug 3382) Versions affected: 0.99.6 to 1.0.6, CVE-2009-1210.

- The Check Point High-Availability Protocol (CPHAP) dissector could crash. (Bug 3269) Versions affected: 0.9.6 to 1.0.6; CVE-2009-1268.

- Wireshark could crash while loading a Tektronix .rf5 file. (Bug 3366) Versions affected: 0.99.6 to 1.0.6, CVE-2009-1269.

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1210     A format string vulnerability was discovered in the     PROFINET dissector.

  - CVE-2009-1268     The dissector for the Check Point High-Availability     Protocol could be forced to crash.

  - CVE-2009-1269     Malformed Tektronix files could lead to a crash.

The old stable distribution (etch), is only affected by the CPHAP crash, which doesn't warrant an update on its own. The fix will be queued up for an upcoming security update or a point release.

Multiple vulnerabilities has been identified and corrected in wireshark :

o The PROFINET dissector was vulnerable to a format string overflow (CVE-2009-1210).

o The Check Point High-Availability Protocol (CPHAP) dissecto could crash (CVE-2009-1268).

o Wireshark could crash while loading a Tektronix .rf5 file (CVE-2009-1269).

This update provides Wireshark 1.0.7, which is not vulnerable to these issues.

The installed version of Wireshark or Ethereal is affected by multiple issues :

  - The PROFINET dissector is affected by a format string     vulnerability which an attacker could exploit to execute     arbitrary code. (Bug 3372)

  - Wireshark could crash while reading a malformed LDAP     capture file. (Bug 3262)

  - Wireshark could crash while reading a malformed Check     Point High-Availability Protocol capture file.     (Bug 3269)

  - Wireshark could crash while reading a Tektronix .rf5     capture file. (Bug 3366)

ID	Name	Product	Family	Severity
67871	Oracle Linux 3 / 4 / 5 : wireshark (ELSA-2009-1100)	Nessus	Oracle Linux Local Security Checks	critical
60596	Scientific Linux Security Update : wireshark on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
44807	Debian DSA-1942-1 : wireshark - several vulnerabilities	Nessus	Debian Local Security Checks	high
41506	SuSE 10 Security Update : ethereal (ZYPP Patch Number 6269)	Nessus	SuSE Local Security Checks	critical
41460	SuSE 11 Security Update : wireshark (SAT Patch Number 910)	Nessus	SuSE Local Security Checks	critical
41303	SuSE9 Security Update : ethereal (YOU Patch Number 12424)	Nessus	SuSE Local Security Checks	critical
40323	openSUSE Security Update : wireshark (wireshark-912)	Nessus	SuSE Local Security Checks	critical
40154	openSUSE Security Update : wireshark (wireshark-912)	Nessus	SuSE Local Security Checks	critical
39580	GLSA-200906-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
39423	CentOS 3 / 5 : wireshark (CESA-2009:1100)	Nessus	CentOS Local Security Checks	critical
39411	RHEL 3 / 4 / 5 : wireshark (RHSA-2009:1100)	Nessus	Red Hat Local Security Checks	critical
38924	openSUSE 10 Security Update : wireshark (wireshark-6271)	Nessus	SuSE Local Security Checks	critical
38907	Fedora 10 : wireshark-1.0.8-1.fc10 (2009-5382)	Nessus	Fedora Local Security Checks	critical
38904	Fedora 9 : wireshark-1.0.8-1.fc9 (2009-5339)	Nessus	Fedora Local Security Checks	critical
38796	Fedora 10 : wireshark-1.0.7-1.fc10 (2009-3599)	Nessus	Fedora Local Security Checks	critical
38728	FreeBSD : wireshark -- multiple vulnerabilities (defce068-39aa-11de-a493-001b77d09812)	Nessus	FreeBSD Local Security Checks	critical
38666	Debian DSA-1785-1 : wireshark - several vulnerabilities	Nessus	Debian Local Security Checks	critical
36918	Mandriva Linux Security Advisory : wireshark (MDVSA-2009:088)	Nessus	Mandriva Local Security Checks	critical
36127	Wireshark / Ethereal 0.99.2 to 1.0.6 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2009-1268

high

Tenable Plugins

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high