Unspecified vulnerability in the PCNFSD dissector in Wireshark 0.8.20 through 1.0.7 allows remote attackers to cause a denial of service (crash) via crafted PCNFSD packets.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1100 advisory.

    [1.0.8-1.0.1.el5_3.1]
    - Add oracle-ocfs2-network.patch

    [1.0.8-1.1]
    - bump release to match Z-stream/EUS NVR policy
    - Resolves: #501950

    [1.0.8-1]
    - upgrade to 1.0.8
    - Resolves: #501950

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A format string flaw was found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-1210)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-1268, CVE-2009-1269, CVE-2009-1829)

All running instances of Wireshark must be restarted for the update to take effect.

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2560     A NULL pointer dereference was found in the RADIUS     dissector.

  - CVE-2009-3550     A NULL pointer dereference was found in the DCERP/NT     dissector.

  - CVE-2009-3829     An integer overflow was discovered in the ERF parser.

This update also includes fixes for three minor issues (CVE-2008-1829, CVE-2009-2562, CVE-2009-3241 ), which were scheduled for the next stable point update. Also CVE-2009-1268 was fixed for Etch. Since this security update was issued prior to the release of the point update, the fixes were included.

The remote host is affected by the vulnerability described in GLSA-200906-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark:
    David Maciejak discovered a vulnerability in packet-usb.c in the USB     dissector via a malformed USB Request Block (URB) (CVE-2008-4680).
    Florent Drouin and David Maciejak reported an unspecified vulnerability     in the Bluetooth RFCOMM dissector (CVE-2008-4681).
    A malformed Tamos CommView capture file (aka .ncf file) with an     'unknown/unexpected packet type' triggers a failed assertion in wtap.c     (CVE-2008-4682).
    An unchecked packet length parameter in the dissect_btacl() function in     packet-bthci_acl.c in the Bluetooth ACL dissector causes an erroneous     tvb_memcpy() call (CVE-2008-4683).
    A vulnerability where packet-frame does not properly handle exceptions     thrown by post dissectors caused by a certain series of packets     (CVE-2008-4684).
    Mike Davies reported a use-after-free vulnerability in the     dissect_q931_cause_ie() function in packet-q931.c in the Q.931     dissector via certain packets that trigger an exception     (CVE-2008-4685).
    The Security Vulnerability Research Team of Bkis reported that the SMTP     dissector could consume excessive amounts of CPU and memory     (CVE-2008-5285).
    The vendor reported that the WLCCP dissector could go into an infinite     loop (CVE-2008-6472).
    babi discovered a buffer overflow in wiretap/netscreen.c via a     malformed NetScreen snoop file (CVE-2009-0599).
    A specially crafted Tektronix K12 text capture file can cause an     application crash (CVE-2009-0600).
    A format string vulnerability via format string specifiers in the HOME     environment variable (CVE-2009-0601).
    THCX Labs reported a format string vulnerability in the     PROFINET/DCP (PN-DCP) dissector via a PN-DCP packet with format string     specifiers in the station name (CVE-2009-1210).
    An unspecified vulnerability with unknown impact and attack vectors     (CVE-2009-1266).
    Marty Adkins and Chris Maynard discovered a parsing error in the     dissector for the Check Point High-Availability Protocol (CPHAP)     (CVE-2009-1268).
    Magnus Homann discovered a parsing error when loading a Tektronix .rf5     file (CVE-2009-1269).
    The vendor reported that the PCNFSD dissector could crash     (CVE-2009-1829).
  Impact :

    A remote attacker could exploit these vulnerabilities by sending     specially crafted packets on a network being monitored by Wireshark or     by enticing a user to read a malformed packet trace file which can     trigger a Denial of Service (application crash or excessive CPU and     memory usage) and possibly allow for the execution of arbitrary code     with the privileges of the user running Wireshark.
  Workaround :

    There is no known workaround at this time.

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

A format string flaw was found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-1210)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-1268, CVE-2009-1269, CVE-2009-1829)

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.8, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1100 advisory.

    Wireshark is a program for monitoring network traffic. Wireshark was     previously known as Ethereal.

    A format string flaw was found in Wireshark. If Wireshark read a malformed     packet off a network or opened a malicious dump file, it could crash or,     possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-1210)

    Several denial of service flaws were found in Wireshark. Wireshark could     crash or stop responding if it read a malformed packet off a network, or     opened a malicious dump file. (CVE-2009-1268, CVE-2009-1269, CVE-2009-1829)

    Users of wireshark should upgrade to these updated packages, which contain     Wireshark version 1.0.8, and resolve these issues. All running instances of     Wireshark must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A vulnerability has been identified and corrected in wireshark :

o Unspecified vulnerability in the PCNFSD dissector in Wireshark 0.8.20 through 1.0.7 allows remote attackers to cause a denial of service (crash) via crafted PCNFSD packets (CVE-2009-1829).

This update provides Wireshark 1.0.8, which is not vulnerable to this issue.

Secunia reports :

A vulnerability has been reported in Wireshark, which can be exploited by malicious people to cause a DoS.

The vulnerability is caused due to an error in the PCNFSD dissector and can be exploited to cause a crash via a specially crafted PCNFSD packet.

Update to 1.0.8 fixes various security flaws.
http://www.wireshark.org/security/wnpa-sec-2009-03.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upgrade to 1.0.8 fixes various security flaws.
http://www.wireshark.org/security/wnpa-sec-2009-02.html http://www.wireshark.org/security/wnpa-sec-2009-03.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
67871	Oracle Linux 5 : wireshark (ELSA-2009-1100)	Nessus	Oracle Linux Local Security Checks	high
60596	Scientific Linux Security Update : wireshark on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
44807	Debian DSA-1942-1 : wireshark - several vulnerabilities	Nessus	Debian Local Security Checks	high
39580	GLSA-200906-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
39423	CentOS 3 / 5 : wireshark (CESA-2009:1100)	Nessus	CentOS Local Security Checks	critical
39411	RHEL 4 / 5 : wireshark (RHSA-2009:1100)	Nessus	Red Hat Local Security Checks	high
38981	Mandriva Linux Security Advisory : wireshark (MDVSA-2009:125)	Nessus	Mandriva Local Security Checks	medium
38967	FreeBSD : wireshark -- PCNFSD Dissector Denial of Service Vulnerability (a2d4a330-4d54-11de-8811-0030843d3802)	Nessus	FreeBSD Local Security Checks	medium
38907	Fedora 10 : wireshark-1.0.8-1.fc10 (2009-5382)	Nessus	Fedora Local Security Checks	critical
38904	Fedora 9 : wireshark-1.0.8-1.fc9 (2009-5339)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2009-1829

high

Tenable Plugins

high

critical

high

critical

critical

high

medium

medium

critical

critical