Buffer overflow in the reassemble_message function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a series of fragmented RLC packets.

The remote Solaris system is missing necessary patches to address security updates :

  - The dissect_packet function in epan/packet.c in     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service     (application crash) via a long packet in a capture file,     as demonstrated by an airopeek file. (CVE-2012-0041)

  - Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     does not properly perform certain string conversions,     which allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash)     via a crafted packet, related to epan/to_str.c.
    (CVE-2012-0042)

  - Buffer overflow in the reassemble_message function in     epan/dissectors/ packet-rlc.c in the RLC dissector in     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via a series of fragmented RLC packets. (CVE-2012-0043)

  - Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service     (application crash) via a long packet in a (1) Accellent     5Views (aka .5vw) file, (2) I4B trace file, or (3)     NETMON 2 capture file. (CVE-2012-0066)

  - wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and     1.6.x before 1.6.5 allows remote attackers to cause a     denial of service (application crash) via a long packet     in an AIX iptrace file. (CVE-2012-0067)

  - The lanalyzer_read function in wiretap/lanalyzer.c in     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service     (application crash) via a Novell catpure file containing     a record that is too small. (CVE-2012-0068)

This update fixes the following security issues :

  - 741187: multiple file parser vulnerabilities     (CVE-2012-0041)

  - 741188: RLC dissector buffer overflow (CVE-2012-0043)

  - 741190: NULL pointer vulnerabilities (CVE-2012-0042)

  - CVE-2012-0066: DoS due to too large buffer alloc request

  - CVE-2012-0067: DoS due to integer underflow and too     large buffer alloc. request

  - CVE-2012-0068: memory corruption due to buffer underflow

Wireshark version 1.4.11 fixes several security issues

The remote host is affected by the vulnerability described in GLSA-201308-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This version upgrade of wireshark to 1.4.11 fixes the following security issues :

  - RLC dissector buffer overflow. (CVE-2012-0043)

  - multiple file parser vulnerabilities. (CVE-2012-0041)

  - NULL pointer vulnerabilities. (CVE-2012-0042)

  - DoS due to too large buffer alloc request.
    (CVE-2012-0066)

  - DoS due to integer underflow and too large buffer alloc.
    request. (CVE-2012-0067)

  - memory corruption due to buffer underflow Additionally,     various other non-security issues were resolved.
    (CVE-2012-0068)

The following vulnerabilities have been fixed. wnpa-sec-2012-01 Laurent Butti discovered that Wireshark failed to properly record sizes for many packet capture file formats.

wnpa-sec-2012-02 Wireshark could dereference a NULL pointer and crash

wnpa-sec-2012-03 The RLC dissector could overflow a buffer

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following vulnerabilities have been fixed.

wnpa-sec-2012-01 Laurent Butti discovered that Wireshark failed to properly record sizes for many packet capture file formats.

wnpa-sec-2012-02 Wireshark could dereference a NULL pointer and crash

wnpa-sec-2012-03 The RLC dissector could overflow a buffer

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Wireshark is 1.6.x before 1.6.5.  This version is affected by the following vulnerabilities :

  - Errors exist in the parsers for '5views', 'i4b',     'iptrace', 'netmon2' and 'novell' packets that can lead     to application crashes. (Issues #6663, 6666, 6667,     6668, 6669, 6670)

  - An unspecified error exists in the display processing     of certain packets that can lead to a NULL pointer     dereference. (Issue #6634)

  - A buffer overflow exists in the 'RLC' dissector.
    (Issue #6391)

The installed version of Wireshark is 1.4.x before 1.4.11.  This version is affected by the following vulnerabilities :

  - Errors exist in the parsers for '5views', 'i4b',     'iptrace', 'netmon2' and 'novell' packets that can lead     to application crashes. (Issues #6663, 6666, 6667,     6668, 6669, 6670)

  - An unspecified error exists in the display processing     of certain packets that can lead to a NULL pointer     dereference. (Issue #6634)

  - A buffer overflow exists in the 'RLC' dissector.
    (Issue #6391)

ID	Name	Product	Family	Severity
80801	Oracle Solaris Third-Party Patch Update : wireshark (multiple_denial_of_service_vulnerabilities2)	Nessus	Solaris Local Security Checks	medium
76047	openSUSE Security Update : wireshark (openSUSE-SU-2012:0295-1)	Nessus	SuSE Local Security Checks	medium
74551	openSUSE Security Update : wireshark (openSUSE-2012-123)	Nessus	SuSE Local Security Checks	medium
69500	GLSA-201308-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
58117	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7943)	Nessus	SuSE Local Security Checks	medium
58115	SuSE 11.1 Security Update : wireshark (SAT Patch Number 5741)	Nessus	SuSE Local Security Checks	medium
57670	Fedora 15 : wireshark-1.4.11-1.fc15 (2012-0440)	Nessus	Fedora Local Security Checks	medium
57624	Fedora 16 : wireshark-1.6.5-1.fc16 (2012-0435)	Nessus	Fedora Local Security Checks	medium
57539	Wireshark 1.6.x < 1.6.5 Multiple Vulnerabilities	Nessus	Windows	high
57538	Wireshark 1.4.x < 1.4.11 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2012-0043

critical

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium

high

high