epan/dissectors/packet-diameter.c in the DIAMETER dissector in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 does not properly construct certain array data structures, which allows remote attackers to cause a denial of service (application crash) via a crafted packet that triggers incorrect memory allocation.

The remote Solaris system is missing necessary patches to address security updates :

  - Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8     allows remote attackers to cause a denial of service     (infinite loop) via vectors related to the (1) ANSI MAP,     (2) ASF, (3) IEEE 802.11, (4) IEEE 802.3, and (5) LTP     dissectors. (CVE-2012-2392)

  - epan/dissectors/packet-diameter.c in the DIAMETER     dissector in Wireshark 1.4.x before 1.4.13 and 1.6.x     before 1.6.8 does not properly construct certain array     data structures, which allows remote attackers to cause     a denial of service (application crash) via a crafted     packet that triggers incorrect memory allocation.
    (CVE-2012-2393)

  - Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 on     the SPARC and Itanium platforms does not properly     perform data alignment for a certain structure member,     which allows remote attackers to cause a denial of     service (application crash) via a (1) ICMP or (2) ICMPv6     Echo Request packet. (CVE-2012-2394)

  - The PPP dissector in Wireshark 1.4.x before 1.4.14,     1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote     attackers to cause a denial of service (invalid pointer     dereference and application crash) via a crafted packet,     as demonstrated by a usbmon dump. (CVE-2012-4048)

  - epan/dissectors/packet-nfs.c in the NFS dissector in     Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and     1.8.x before 1.8.1 allows remote attackers to cause a     denial of service (loop and CPU consumption) via a     crafted packet. (CVE-2012-4049)

This update is a maintenance release of Wireshark. It fixes some vulererabilities when dissecting certain protocols. As packages for these protocols may be received over the network, an attacker may trigger infinite or large loops or crashes of the dissector. Wireshark release notes and advisories :

- http://www.wireshark.org/docs/relnotes/wireshark-1.4.13.html

- http://www.wireshark.org/security/wnpa-sec-2012-08.html

  - CVE-2012-2392

- http://www.wireshark.org/security/wnpa-sec-2012-09.html

  - CVE-2012-2393

- http://www.wireshark.org/security/wnpa-sec-2012-10.html

  - CVE-2012-2394

Multiple vulnerabilities has been found and corrected in wireshark :

Infinite and large loops in ANSI MAP, BACapp, Bluetooth HCI, IEEE 802.3, LTP, and R3 dissectors have been fixed. Discovered by Laurent Butti (http://www.wireshark.org/security/wnpa-sec-2012-08.html [CVE-2012-2392])

The DIAMETER dissector could try to allocate memory improperly and crash (http://www.wireshark.org/security/wnpa-sec-2012-09.html [CVE-2012-2393])

Wireshark could crash on SPARC processors due to misaligned memory.
Discovered by Klaus Heckelmann (http://www.wireshark.org/security/wnpa-sec-2012-10.html [CVE-2012-2394])

The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted packet, as demonstrated by a usbmon dump (CVE-2012-4048).

epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet (CVE-2012-4049).

The DCP ETSI dissector could trigger a zero division (CVE-2012-4285).

The XTP dissector could go into an infinite loop (CVE-2012-4288).

The AFP dissector could go into a large loop (CVE-2012-4289).

The RTPS2 dissector could overflow a buffer (CVE-2012-4296).

The GSM RLC MAC dissector could overflow a buffer (CVE-2012-4297).

The CIP dissector could exhaust system memory (CVE-2012-4291).

The STUN dissector could crash (CVE-2012-4292).

The EtherCAT Mailbox dissector could abort (CVE-2012-4293).

The CTDB dissector could go into a large loop (CVE-2012-4290).

Martin Wilck discovered an infinite loop in the DRDA dissector (CVE-2012-5239).

The USB dissector could go into an infinite loop. (wnpa-sec-2012-31)

The ISAKMP dissector could crash. (wnpa-sec-2012-35)

The iSCSI dissector could go into an infinite loop. (wnpa-sec-2012-36)

The WTP dissector could go into an infinite loop. (wnpa-sec-2012-37)

The RTCP dissector could go into an infinite loop. (wnpa-sec-2012-38)

The ICMPv6 dissector could go into an infinite loop.
(wnpa-sec-2012-40)

Infinite and large loops in the Bluetooth HCI, CSN.1, DCP-ETSI DOCSIS CM-STAUS, IEEE 802.3 Slow Protocols, MPLS, R3, RTPS, SDP, and SIP dissectors (wnpa-sec-2013-01).

The CLNP dissector could crash (wnpa-sec-2013-02).

The DTN dissector could crash (wnpa-sec-2013-03).

The MS-MMC dissector (and possibly others) could crash (wnpa-sec-2013-04).

The DTLS dissector could crash (wnpa-sec-2013-05).

The DCP-ETSI dissector could corrupt memory (wnpa-sec-2013-07).

The Wireshark dissection engine could crash (wnpa-sec-2013-08).

The NTLMSSP dissector could overflow a buffer (wnpa-sec-2013-09).

The sFlow dissector could go into an infinite loop (CVE-2012-6054).

The SCTP dissector could go into an infinite loop (CVE-2012-6056).

The MS-MMS dissector could crash (CVE-2013-2478).

The RTPS and RTPS2 dissectors could crash (CVE-2013-2480).

The Mount dissector could crash (CVE-2013-2481).

The AMPQ dissector could go into an infinite loop (CVE-2013-2482).

The ACN dissector could attempt to divide by zero (CVE-2013-2483).

The CIMD dissector could crash (CVE-2013-2484).

The FCSP dissector could go into an infinite loop (CVE-2013-2485).

The DTLS dissector could crash (CVE-2013-2488).

This advisory provides the latest version of Wireshark (1.6.14) which is not vulnerable to these issues.

This version upgrade of wireshark fixes multiple denial of service flaws :

  - denial of service via memory alignment flaw.
    (CVE-2012-2394)

  - DIAMETER memory allocation flaw. (CVE-2012-2393)

  - denial of service in multiple dissectors / parsers     Additionally, various other non-security bug fixes were     introduced. (CVE-2012-2392)

Multiple vulnerabilities was found and corrected in Wireshark :

It may be possible to make Wireshark hang for long or indefinite periods by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

This advisory provides the latest version of Wireshark (1.6.8) which is not vulnerable to these issues.

Multiple file parser and NULL pointer vulnerabilities including a RLC dissector buffer overflow was found and corrected in Wireshark.

This advisory provides the latest version of Wireshark (1.6.5 ) which is not vulnerable to these issues.

Update to latest upstream release, fixing few security bugs.

CVE-2012-2392: Infinite and large loops in ANSI MAP, ASF, IEEE 802.11, IEEE 802.3, and LTP dissectors.

CVE-2012-2393: Memory allocation flaw in the DIAMETER dissector.

CVE-2012-2394: Denial of service (crash) due memory alignment problem on SPARC and Itanium processors.

CVE-2012-3825: Integer overflows in BACapp and Bluetooth HCI dissectors, leading to DoS

CVE-2012-3826: Integer overflows in the R3 dissector, leading to DoS.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This version upgrade of wireshark fixes multiple denial of service flaws :

  - denial of service via memory alignment flaw.
    (CVE-2012-2394)

  - DIAMETER memory allocation flaw. (CVE-2012-2393)

  - denial of service in multiple dissectors / parsers     Additionally, various other non-security bug fixes have     been introduced. (CVE-2012-2392)

The installed version of Wireshark is 1.6.x before 1.6.8.  This version is affected by the following vulnerabilities :

  - Input validation errors exist in the dissectors for     ANSI MAP, ASF, BACapp, Bluetooth HCI, IEEE 802.11,     IEEE 802.3, LTP, and R3 that can allow specially crafted     packets to cause the application to enter infinite or     very large loops making it unavailable. (Issues 6805,     7118, 7119, 7120, 7121, 7122, 7124, 7125)

  - An input validation error exists in the DIAMETER     dissector that can allow specially crafted packets to     cause improper memory allocation leading to application     crashes. (Issue 7138)

  - An unspecified error can cause the application to crash     due to a memory misalignment. Note, for Windows, this     issue only occurs on the Itanium platform. (Issue 7221)

The installed version of Wireshark is 1.4.x before 1.4.13.  This version is affected by the following vulnerabilities :

  - Input validation errors exist in the dissectors for     ANSI MAP, ASF, BACapp, Bluetooth HCI, IEEE 802.11,     IEEE 802.3, LTP, and R3 that can allow specially crafted     packets to cause the application to enter infinite or     very large loops making it unavailable. (Issues 6805,     7118, 7119, 7120, 7121, 7122, 7124, 7125)

  - An input validation error exists in the DIAMETER     dissector that can allow specially crafted packets to     cause improper memory allocation leading to application     crashes. (Issue 7138)

  - An unspecified error can cause the application to crash     due to a memory misalignment. Note, for Windows, this     issue only occurs on the Itanium platform. (Issue 7221)

ID	Name	Product	Family	Severity
80803	Oracle Solaris Third-Party Patch Update : wireshark (multiple_vulnerabilities_in_wireshark1)	Nessus	Solaris Local Security Checks	low
74636	openSUSE Security Update : wireshark (openSUSE-SU-2012:0657-1)	Nessus	SuSE Local Security Checks	low
66069	Mandriva Linux Security Advisory : wireshark (MDVSA-2013:055)	Nessus	Mandriva Local Security Checks	high
64230	SuSE 11.1 Security Update : wireshark (SAT Patch Number 6381)	Nessus	SuSE Local Security Checks	low
61953	Mandriva Linux Security Advisory : wireshark (MDVSA-2012:080)	Nessus	Mandriva Local Security Checks	low
61943	Mandriva Linux Security Advisory : wireshark (MDVSA-2012:015)	Nessus	Mandriva Local Security Checks	low
59940	Fedora 16 : wireshark-1.6.8-1.fc16 (2012-10175)	Nessus	Fedora Local Security Checks	low
59723	SuSE 10 Security Update : wireshark (ZYPP Patch Number 8168)	Nessus	SuSE Local Security Checks	low
59240	Wireshark 1.6.x < 1.6.8 Multiple Denial of Service Vulnerabilities	Nessus	Windows	low
59239	Wireshark 1.4.x < 1.4.13 Multiple Denial of Service Vulnerabilities	Nessus	Windows	low

Detections

Analytics

CVE-2012-2393

high

Tenable Plugins

low

low

high

low

low

low

low

low

low

low