http://anonsvn.wireshark.org/viewvc?view=revision&revision=38430

MDVSA-2011:138

[oss-security] 20110913 CVE Request: Multiple issues fixed in wireshark 1.6.2

[oss-security] 20110914 Re: CVE Request: Multiple issues fixed in wireshark 1.6.2

http://www.wireshark.org/security/wnpa-sec-2011-16.html

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6139

https://bugzilla.redhat.com/show_bug.cgi?id=737783

oval:org.mitre.oval:def:14886

This advisory updates wireshark to the latest version (1.6.2), fixing several security issues :

The proto_tree_add_item function in Wireshark 1.6.1, when the IKEv1 protocol dissector is used, allows user-assisted remote attackers to cause a denial of service (infinite loop) via vectors involving a malformed IKE packet and many items in a tree (CVE-2011-3266).

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory (CVE-2011-3360).

The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.2 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (application crash) via a malformed packet (CVE-2011-3482).

Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (application crash) via a malformed capture file that leads to an invalid root tvbuff, related to a buffer exception handling vulnerability. (CVE-2011-3483).

The unxorFrame function in epan/dissectors/packet-opensafety.c in the OpenSafety dissector in Wireshark 1.6.x before 1.6.2 does not properly validate a certain frame size, which allows remote attackers to cause a denial of service (loop and application crash) via a malformed packet (CVE-2011-3484).

The updated packages have been upgraded to the latest 1.6.x version (1.6.2) which is not vulnerable to these issues.

The remote host is affected by the vulnerability described in GLSA-201110-02 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send specially crafted packets on a network       being monitored by Wireshark, entice a user to open a malformed packet       trace file using Wireshark, or deploy a specially crafted Lua script for       use by Wireshark, possibly resulting in the execution of arbitrary code,       or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The installed version of Wireshark is 1.6.x before 1.6.2.  This version is affected by the following vulnerabilities :

  - An error exists in IKE dissector that can allow denial     of service attacks when processing certain malformed     packets. (CVE-2011-3266)

  - A buffer exception handling vulnerability exists that     can allow denial of service attacks when processing     certain malformed packets. (Issue #6135)

  - It may be possible to make Wireshark execute Lua scripts     using a method similar to DLL hijacking. (Issue #6136)

  - An error exists in OpenSafety dissector that can allow     denial of service attacks when processing certain     malformed packets. (Issue #6138)

  - An error exists in CSN.1 dissector that can allow denial     of service attacks when processing certain malformed     packets. (Issue #6139)

ID	Name	Product	Family	Severity
61928	Mandriva Linux Security Advisory : wireshark (MDVSA-2011:138)	Nessus	Mandriva Local Security Checks	high
56426	GLSA-201110-02 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
56164	Wireshark 1.6.x < 1.6.2 Multiple Vulnerabilities	Nessus	Windows	medium

CVE-2011-3482

medium

Tenable Plugins

high

critical

medium