Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (application crash) via a malformed capture file that leads to an invalid root tvbuff, related to a "buffer exception handling vulnerability."

This update of wireshark fixes the following vulnerabilities :

  - CVE-2011-3266: Wireshark IKE dissector vulnerability

  - CVE-2011-3360: Wireshark Lua script execution     vulnerability

  - CVE-2011-3483: Wireshark buffer exception handling     vulnerability

  - CVE-2011-2597: Lucent/Ascend file parser susceptible to     infinite loop

  - CVE-2011-2698: ANSI MAP dissector susceptible to     infinite loop

  - CVE-2011-1957: Large/infinite loop in the DICOM     dissector

  - CVE-2011-1959: A corrupted snoop file could crash     Wireshark

  - CVE-2011-2174: Malformed compressed capture data could     crash Wireshark

  - CVE-2011-2175: A corrupted Visual Networks file could     crash Wireshark

  - CVE-2011-1958: dereferene a NULL pointer if we had a     corrupted Diameter dictionary

This update of wireshark fixes the following vulnerabilities :

  - CVE-2011-3266: Wireshark IKE dissector vulnerability

  - CVE-2011-3360: Wireshark Lua script execution     vulnerability

  - CVE-2011-3483: Wireshark buffer exception handling     vulnerability 

  - CVE-2011-2597: Lucent/Ascend file parser susceptible to     infinite loop

  - CVE-2011-2698: ANSI MAP dissector susceptible to     infinite loop 

  - CVE-2011-1957: Large/infinite loop in the DICOM     dissector

  - CVE-2011-1959: A corrupted snoop file could crash     Wireshark

  - CVE-2011-2174: Malformed compressed capture data could     crash Wireshark

  - CVE-2011-2175: A corrupted Visual Networks file could     crash Wireshark

  - CVE-2011-1958: dereferene a NULL pointer if we had a     corrupted Diameter dictionary

This advisory updates wireshark to the latest version (1.6.2), fixing several security issues :

The proto_tree_add_item function in Wireshark 1.6.1, when the IKEv1 protocol dissector is used, allows user-assisted remote attackers to cause a denial of service (infinite loop) via vectors involving a malformed IKE packet and many items in a tree (CVE-2011-3266).

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory (CVE-2011-3360).

The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.2 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (application crash) via a malformed packet (CVE-2011-3482).

Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (application crash) via a malformed capture file that leads to an invalid root tvbuff, related to a buffer exception handling vulnerability. (CVE-2011-3483).

The unxorFrame function in epan/dissectors/packet-opensafety.c in the OpenSafety dissector in Wireshark 1.6.x before 1.6.2 does not properly validate a certain frame size, which allows remote attackers to cause a denial of service (loop and application crash) via a malformed packet (CVE-2011-3484).

The updated packages have been upgraded to the latest 1.6.x version (1.6.2) which is not vulnerable to these issues.

Laurent Butti discovered a buffer underflow in the LANalyzer dissector of the Wireshark network traffic analyzer, which could lead to the execution of arbitrary code (CVE-2012-0068 ).

This update also addresses several bugs, which can lead to crashes of Wireshark. These are not treated as security issues, but are fixed nonetheless if security updates are scheduled: CVE-2011-3483, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066 and CVE-2012-0067.

This update of wireshark fixes the following vulnerabilities :

  - Wireshark IKE dissector vulnerability. (CVE-2011-3266)

  - Wireshark Lua script execution vulnerability.
    (CVE-2011-3360)

  - Wireshark buffer exception handling vulnerability.
    (CVE-2011-3483)

  - Lucent/Ascend file parser susceptible to infinite loop.
    (CVE-2011-2597)

  - ANSI MAP dissector susceptible to infinite loop.
    (CVE-2011-2698)

  - Large/infinite loop in the DICOM dissector.
    (CVE-2011-1957)

  - A corrupted snoop file could crash Wireshark.
    (CVE-2011-1959)

  - Malformed compressed capture data could crash Wireshark.
    (CVE-2011-2174)

  - A corrupted Visual Networks file could crash Wireshark.
    (CVE-2011-2175)

  - dereferene a NULL pointer if we had a corrupted Diameter     dictionary. (CVE-2011-1958)

The remote host is affected by the vulnerability described in GLSA-201110-02 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send specially crafted packets on a network       being monitored by Wireshark, entice a user to open a malformed packet       trace file using Wireshark, or deploy a specially crafted Lua script for       use by Wireshark, possibly resulting in the execution of arbitrary code,       or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The installed version of Wireshark is 1.6.x before 1.6.2.  This version is affected by the following vulnerabilities :

  - An error exists in IKE dissector that can allow denial     of service attacks when processing certain malformed     packets. (CVE-2011-3266)

  - A buffer exception handling vulnerability exists that     can allow denial of service attacks when processing     certain malformed packets. (Issue #6135)

  - It may be possible to make Wireshark execute Lua scripts     using a method similar to DLL hijacking. (Issue #6136)

  - An error exists in OpenSafety dissector that can allow     denial of service attacks when processing certain     malformed packets. (Issue #6138)

  - An error exists in CSN.1 dissector that can allow denial     of service attacks when processing certain malformed     packets. (Issue #6139)

ID	Name	Product	Family	Severity
76045	openSUSE Security Update : wireshark (openSUSE-SU-2011:1142-1)	Nessus	SuSE Local Security Checks	high
75774	openSUSE Security Update : wireshark (openSUSE-SU-2011:1142-1)	Nessus	SuSE Local Security Checks	high
61928	Mandriva Linux Security Advisory : wireshark (MDVSA-2011:138)	Nessus	Mandriva Local Security Checks	high
57735	Debian DSA-2395-1 : wireshark - buffer underflow	Nessus	Debian Local Security Checks	medium
57263	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7796)	Nessus	SuSE Local Security Checks	high
57136	SuSE 11.1 Security Update : wireshark (SAT Patch Number 5281)	Nessus	SuSE Local Security Checks	high
56617	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7795)	Nessus	SuSE Local Security Checks	high
56426	GLSA-201110-02 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
56164	Wireshark 1.6.x < 1.6.2 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2011-3483

high

Tenable Plugins

high

high

high

medium

high

high

high

critical

medium