The dissect_infiniband_common function in epan/dissectors/packet-infiniband.c in the Infiniband dissector in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed packet.

The remote Solaris system is missing necessary patches to address security updates :

  - The proto_tree_add_item function in Wireshark 1.6.0     through 1.6.1 and 1.4.0 through 1.4.8, when the IKEv1     protocol dissector is used, allows user-assisted remote     attackers to cause a denial of service (infinite loop)     via vectors involving a malformed IKE packet and many     items in a tree. (CVE-2011-3266)

  - Untrusted search path vulnerability in Wireshark 1.4.x     before 1.4.9 and 1.6.x before 1.6.2 allows local users     to gain privileges via a Trojan horse Lua script in an     unspecified directory. (CVE-2011-3360)

  - The dissect_infiniband_common function in     epan/dissectors/packet-infiniband.c in the Infiniband     dissector in Wireshark 1.4.0 through 1.4.9 and 1.6.x     before 1.6.3 allows remote attackers to cause a denial     of service (NULL pointer dereference and application     crash) via a malformed packet. (CVE-2011-4101)

This advisory updates wireshark to the latest version (1.6.3), fixing several security issues :

An uninitialized variable in the CSN.1 dissector could cause a crash (CVE-2011-4100).

Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL pointer (CVE-2011-4101).

Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a buffer overflow in the ERF file reader (CVE-2011-4102).

The updated packages have been upgraded to the latest 1.6.x version (1.6.3) which is not vulnerable to these issues.

The installed version of Wireshark is 1.6.x before 1.6.3.  This version is affected by the following vulnerabilities :

  - An error exists in CSN.1 dissector that can allow denial     of service attacks when processing certain malformed     packets. (CVE-2011-4100)

  - An error exists in the Infiniband dissector that can     allow a NULL pointer to be dereferenced when processing     certain malformed packets. (CVE-2011-4101)

  - A buffer overflow exists in the ERF file reader and can     be triggered when processing certain malformed packets.
    (CVE-2011-4102)

The installed version of Wireshark is 1.4.x before 1.4.10.  This version is affected by the following vulnerabilities :

  - An error exists in the Infiniband dissector that can     allow a NULL pointer to be dereferenced when processing     certain malformed packets. (CVE-2011-4101)

  - A buffer overflow exists in the ERF file reader and can     be triggered when processing certain malformed packets.
    (CVE-2011-4102)

ID	Name	Product	Family	Type	Severity
80800	Oracle Solaris Third-Party Patch Update : wireshark (denial_of_service_vulnerability_in)	Nessus	Solaris Local Security Checks	Local	high
61934	Mandriva Linux Security Advisory : wireshark (MDVSA-2011:164)	Nessus	Mandriva Local Security Checks	Local	medium
56690	Wireshark 1.6.x < 1.6.3 Multiple Vulnerabilities	Nessus	Windows	Local	medium
56689	Wireshark 1.4.x < 1.4.10 Multiple Vulnerabilities	Nessus	Windows	Local	medium

Detections

Analytics

CVE-2011-4101

high

Tenable Plugins

high

medium

medium

medium