The lanalyzer_read function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a Novell capture file containing a record that is too small.

The remote Solaris system is missing necessary patches to address security updates :

  - The dissect_packet function in epan/packet.c in     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service     (application crash) via a long packet in a capture file,     as demonstrated by an airopeek file. (CVE-2012-0041)

  - Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     does not properly perform certain string conversions,     which allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash)     via a crafted packet, related to epan/to_str.c.
    (CVE-2012-0042)

  - Buffer overflow in the reassemble_message function in     epan/dissectors/ packet-rlc.c in the RLC dissector in     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via a series of fragmented RLC packets. (CVE-2012-0043)

  - Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service     (application crash) via a long packet in a (1) Accellent     5Views (aka .5vw) file, (2) I4B trace file, or (3)     NETMON 2 capture file. (CVE-2012-0066)

  - wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and     1.6.x before 1.6.5 allows remote attackers to cause a     denial of service (application crash) via a long packet     in an AIX iptrace file. (CVE-2012-0067)

  - The lanalyzer_read function in wiretap/lanalyzer.c in     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service     (application crash) via a Novell catpure file containing     a record that is too small. (CVE-2012-0068)

This update fixes the following security issues :

  - 741187: multiple file parser vulnerabilities     (CVE-2012-0041)

  - 741188: RLC dissector buffer overflow (CVE-2012-0043)

  - 741190: NULL pointer vulnerabilities (CVE-2012-0042)

  - CVE-2012-0066: DoS due to too large buffer alloc request

  - CVE-2012-0067: DoS due to integer underflow and too     large buffer alloc. request

  - CVE-2012-0068: memory corruption due to buffer underflow

Wireshark version 1.4.11 fixes several security issues

The remote host is affected by the vulnerability described in GLSA-201308-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This version upgrade of wireshark to 1.4.11 fixes the following security issues :

  - RLC dissector buffer overflow. (CVE-2012-0043)

  - multiple file parser vulnerabilities. (CVE-2012-0041)

  - NULL pointer vulnerabilities. (CVE-2012-0042)

  - DoS due to too large buffer alloc request.
    (CVE-2012-0066)

  - DoS due to integer underflow and too large buffer alloc.
    request. (CVE-2012-0067)

  - memory corruption due to buffer underflow Additionally,     various other non-security issues were resolved.
    (CVE-2012-0068)

Laurent Butti discovered a buffer underflow in the LANalyzer dissector of the Wireshark network traffic analyzer, which could lead to the execution of arbitrary code (CVE-2012-0068 ).

This update also addresses several bugs, which can lead to crashes of Wireshark. These are not treated as security issues, but are fixed nonetheless if security updates are scheduled: CVE-2011-3483, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066 and CVE-2012-0067.

Wireshark reports :

Laurent Butti discovered that Wireshark failed to properly check record sizes for many packet capture file formats

Wireshark could dereference a NULL pointer and crash.

The RLC dissector could overflow a buffer.

The installed version of Wireshark is 1.6.x before 1.6.5.  This version is affected by the following vulnerabilities :

  - Errors exist in the parsers for '5views', 'i4b',     'iptrace', 'netmon2' and 'novell' packets that can lead     to application crashes. (Issues #6663, 6666, 6667,     6668, 6669, 6670)

  - An unspecified error exists in the display processing     of certain packets that can lead to a NULL pointer     dereference. (Issue #6634)

  - A buffer overflow exists in the 'RLC' dissector.
    (Issue #6391)

The installed version of Wireshark is 1.4.x before 1.4.11.  This version is affected by the following vulnerabilities :

  - Errors exist in the parsers for '5views', 'i4b',     'iptrace', 'netmon2' and 'novell' packets that can lead     to application crashes. (Issues #6663, 6666, 6667,     6668, 6669, 6670)

  - An unspecified error exists in the display processing     of certain packets that can lead to a NULL pointer     dereference. (Issue #6634)

  - A buffer overflow exists in the 'RLC' dissector.
    (Issue #6391)

ID	Name	Product	Family	Severity
80801	Oracle Solaris Third-Party Patch Update : wireshark (multiple_denial_of_service_vulnerabilities2)	Nessus	Solaris Local Security Checks	medium
76047	openSUSE Security Update : wireshark (openSUSE-SU-2012:0295-1)	Nessus	SuSE Local Security Checks	medium
74551	openSUSE Security Update : wireshark (openSUSE-2012-123)	Nessus	SuSE Local Security Checks	medium
69500	GLSA-201308-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
58117	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7943)	Nessus	SuSE Local Security Checks	medium
58115	SuSE 11.1 Security Update : wireshark (SAT Patch Number 5741)	Nessus	SuSE Local Security Checks	medium
57735	Debian DSA-2395-1 : wireshark - buffer underflow	Nessus	Debian Local Security Checks	medium
57646	FreeBSD : Wireshark -- Multiple vulnerabilities (3ebb2dc8-4609-11e1-9f47-00e0815b8da8)	Nessus	FreeBSD Local Security Checks	medium
57539	Wireshark 1.6.x < 1.6.5 Multiple Vulnerabilities	Nessus	Windows	high
57538	Wireshark 1.4.x < 1.4.11 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2012-0068

high

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium

high

high