The unxorFrame function in epan/dissectors/packet-opensafety.c in the OpenSafety dissector in Wireshark 1.6.x before 1.6.2 does not properly validate a certain frame size, which allows remote attackers to cause a denial of service (loop and application crash) via a malformed packet.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.6.2. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.6.2 advisory.

  - The unxorFrame function in epan/dissectors/packet-opensafety.c in the OpenSafety dissector in Wireshark     1.6.x before 1.6.2 does not properly validate a certain frame size, which allows remote attackers to cause     a denial of service (loop and application crash) via a malformed packet. (CVE-2011-3484)

  - Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local     users to gain privileges via a Trojan horse Lua script in an unspecified directory. (CVE-2011-3360)

  - The proto_tree_add_item function in Wireshark 1.6.0 through 1.6.1 and 1.4.0 through 1.4.8, when the IKEv1     protocol dissector is used, allows user-assisted remote attackers to cause a denial of service (infinite     loop) via vectors involving a malformed IKE packet and many items in a tree. (CVE-2011-3266)

  - The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x     before 1.6.2 does not initialize a certain structure member, which allows remote attackers to cause a     denial of service (application crash) via a malformed packet. (CVE-2011-3482)

  - Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (application crash) via     a malformed capture file that leads to an invalid root tvbuff, related to a buffer exception handling     vulnerability. (CVE-2011-3483)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This advisory updates wireshark to the latest version (1.6.2), fixing several security issues :

The proto_tree_add_item function in Wireshark 1.6.1, when the IKEv1 protocol dissector is used, allows user-assisted remote attackers to cause a denial of service (infinite loop) via vectors involving a malformed IKE packet and many items in a tree (CVE-2011-3266).

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory (CVE-2011-3360).

The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.2 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (application crash) via a malformed packet (CVE-2011-3482).

Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (application crash) via a malformed capture file that leads to an invalid root tvbuff, related to a buffer exception handling vulnerability. (CVE-2011-3483).

The unxorFrame function in epan/dissectors/packet-opensafety.c in the OpenSafety dissector in Wireshark 1.6.x before 1.6.2 does not properly validate a certain frame size, which allows remote attackers to cause a denial of service (loop and application crash) via a malformed packet (CVE-2011-3484).

The updated packages have been upgraded to the latest 1.6.x version (1.6.2) which is not vulnerable to these issues.

The version of Wireshark installed on the remote Windows host is prior to 1.6.2. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.6.2 advisory.

  - The unxorFrame function in epan/dissectors/packet-opensafety.c in the OpenSafety dissector in Wireshark     1.6.x before 1.6.2 does not properly validate a certain frame size, which allows remote attackers to cause     a denial of service (loop and application crash) via a malformed packet. (CVE-2011-3484)

  - Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local     users to gain privileges via a Trojan horse Lua script in an unspecified directory. (CVE-2011-3360)

  - The proto_tree_add_item function in Wireshark 1.6.0 through 1.6.1 and 1.4.0 through 1.4.8, when the IKEv1     protocol dissector is used, allows user-assisted remote attackers to cause a denial of service (infinite     loop) via vectors involving a malformed IKE packet and many items in a tree. (CVE-2011-3266)

  - The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x     before 1.6.2 does not initialize a certain structure member, which allows remote attackers to cause a     denial of service (application crash) via a malformed packet. (CVE-2011-3482)

  - Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (application crash) via     a malformed capture file that leads to an invalid root tvbuff, related to a buffer exception handling     vulnerability. (CVE-2011-3483)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
368086	Wireshark 1.6.x < 1.6.2 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	Local	high
61928	Mandriva Linux Security Advisory : wireshark (MDVSA-2011:138)	Nessus	Mandriva Local Security Checks	Local	high
56164	Wireshark 1.6.x < 1.6.2 Multiple Vulnerabilities	Nessus	Windows	Local	high

Detections

Analytics

CVE-2011-3484

high

Tenable Plugins

high

high

high