epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet.

The remote Solaris system is missing necessary patches to address security updates :

  - Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8     allows remote attackers to cause a denial of service     (infinite loop) via vectors related to the (1) ANSI MAP,     (2) ASF, (3) IEEE 802.11, (4) IEEE 802.3, and (5) LTP     dissectors. (CVE-2012-2392)

  - epan/dissectors/packet-diameter.c in the DIAMETER     dissector in Wireshark 1.4.x before 1.4.13 and 1.6.x     before 1.6.8 does not properly construct certain array     data structures, which allows remote attackers to cause     a denial of service (application crash) via a crafted     packet that triggers incorrect memory allocation.
    (CVE-2012-2393)

  - Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 on     the SPARC and Itanium platforms does not properly     perform data alignment for a certain structure member,     which allows remote attackers to cause a denial of     service (application crash) via a (1) ICMP or (2) ICMPv6     Echo Request packet. (CVE-2012-2394)

  - The PPP dissector in Wireshark 1.4.x before 1.4.14,     1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote     attackers to cause a denial of service (invalid pointer     dereference and application crash) via a crafted packet,     as demonstrated by a usbmon dump. (CVE-2012-4048)

  - epan/dissectors/packet-nfs.c in the NFS dissector in     Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and     1.8.x before 1.8.1 allows remote attackers to cause a     denial of service (loop and CPU consumption) via a     crafted packet. (CVE-2012-4049)

- This version update fixes the following security issues     (bnc#772738) :

  - The PPP dissector could crash (wnpa-sec-2012-11     CVE-2012-4048)

  - The NFS dissector could use excessive amounts of CPU     (wnpa-sec-2012-12 CVE-2012-4049)

The remote host is affected by the vulnerability described in GLSA-201308-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities has been found and corrected in wireshark :

Infinite and large loops in ANSI MAP, BACapp, Bluetooth HCI, IEEE 802.3, LTP, and R3 dissectors have been fixed. Discovered by Laurent Butti (http://www.wireshark.org/security/wnpa-sec-2012-08.html [CVE-2012-2392])

The DIAMETER dissector could try to allocate memory improperly and crash (http://www.wireshark.org/security/wnpa-sec-2012-09.html [CVE-2012-2393])

Wireshark could crash on SPARC processors due to misaligned memory.
Discovered by Klaus Heckelmann (http://www.wireshark.org/security/wnpa-sec-2012-10.html [CVE-2012-2394])

The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted packet, as demonstrated by a usbmon dump (CVE-2012-4048).

epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet (CVE-2012-4049).

The DCP ETSI dissector could trigger a zero division (CVE-2012-4285).

The XTP dissector could go into an infinite loop (CVE-2012-4288).

The AFP dissector could go into a large loop (CVE-2012-4289).

The RTPS2 dissector could overflow a buffer (CVE-2012-4296).

The GSM RLC MAC dissector could overflow a buffer (CVE-2012-4297).

The CIP dissector could exhaust system memory (CVE-2012-4291).

The STUN dissector could crash (CVE-2012-4292).

The EtherCAT Mailbox dissector could abort (CVE-2012-4293).

The CTDB dissector could go into a large loop (CVE-2012-4290).

Martin Wilck discovered an infinite loop in the DRDA dissector (CVE-2012-5239).

The USB dissector could go into an infinite loop. (wnpa-sec-2012-31)

The ISAKMP dissector could crash. (wnpa-sec-2012-35)

The iSCSI dissector could go into an infinite loop. (wnpa-sec-2012-36)

The WTP dissector could go into an infinite loop. (wnpa-sec-2012-37)

The RTCP dissector could go into an infinite loop. (wnpa-sec-2012-38)

The ICMPv6 dissector could go into an infinite loop.
(wnpa-sec-2012-40)

Infinite and large loops in the Bluetooth HCI, CSN.1, DCP-ETSI DOCSIS CM-STAUS, IEEE 802.3 Slow Protocols, MPLS, R3, RTPS, SDP, and SIP dissectors (wnpa-sec-2013-01).

The CLNP dissector could crash (wnpa-sec-2013-02).

The DTN dissector could crash (wnpa-sec-2013-03).

The MS-MMC dissector (and possibly others) could crash (wnpa-sec-2013-04).

The DTLS dissector could crash (wnpa-sec-2013-05).

The DCP-ETSI dissector could corrupt memory (wnpa-sec-2013-07).

The Wireshark dissection engine could crash (wnpa-sec-2013-08).

The NTLMSSP dissector could overflow a buffer (wnpa-sec-2013-09).

The sFlow dissector could go into an infinite loop (CVE-2012-6054).

The SCTP dissector could go into an infinite loop (CVE-2012-6056).

The MS-MMS dissector could crash (CVE-2013-2478).

The RTPS and RTPS2 dissectors could crash (CVE-2013-2480).

The Mount dissector could crash (CVE-2013-2481).

The AMPQ dissector could go into an infinite loop (CVE-2013-2482).

The ACN dissector could attempt to divide by zero (CVE-2013-2483).

The CIMD dissector could crash (CVE-2013-2484).

The FCSP dissector could go into an infinite loop (CVE-2013-2485).

The DTLS dissector could crash (CVE-2013-2488).

This advisory provides the latest version of Wireshark (1.6.14) which is not vulnerable to these issues.

wireshark was updated to 1.4.15 to fix multiple security issues.

Issues fixed :

  - fix bnc#776038(CVE-2012-4285 / CVE-2012-4288 /     CVE-2012-4289 / CVE-2012-4296 / CVE-2012-4291 /     CVE-2012-4292 / CVE-2012-4293 / CVE-2012-4290),     bnc#772738 (CVE-2012-4048 / CVE-2012-4049)(fixed     upstream)

  - Security fixes :

  - wnpa-sec-2012-13 The DCP ETSI dissector could trigger a     zero division. Reported by Laurent Butti. (Bug 7566)

  - wnpa-sec-2012-15 The XTP dissector could go into an     infinite loop. Reported by Ben Schmidt. (Bug 7571)

  - wnpa-sec-2012-17 The AFP dissector could go into a large     loop. Reported by Stefan Cornelius. (Bug 7603)

  - wnpa-sec-2012-18 The RTPS2 dissector could overflow a     buffer. Reported by Laurent Butti. (Bug 7568)

  - wnpa-sec-2012-20 The CIP dissector could exhaust system     memory. Reported y Ben Schmidt. (Bug 7570)

  - wnpa-sec-2012-21 The STUN dissector could crash.
    Reported by Laurent Butti. (Bug 7569)

  - wnpa-sec-2012-22 The EtherCAT Mailbox dissector could     abort. Reported by Laurent Butti. (Bug 7562)

  - wnpa-sec-2012-23 The CTDB dissector could go into a     large loop. Reported by Ben Schmidt. (Bug 7573)

  - Bug fixes :

  - Wireshark crashes on opening very short NFS pcap file.
    (Bug 7498)

  - Updated Protocol Support

  - AFP, Bluetooth L2CAP, CIP, CTDB, DCP ETSI, EtherCAT     Mailbox, FC Link Control LISP, NFS, RTPS2, SCTP, STUN,     XTP

wireshark was updated to 1.4.15 to fix multiple security issues.

Issues fixed :

  - fix bnc#776038(CVE-2012-4285 / CVE-2012-4288 /     CVE-2012-4289 / CVE-2012-4296 / CVE-2012-4291 /     CVE-2012-4292 / CVE-2012-4293 / CVE-2012-4290),     bnc#772738 (CVE-2012-4048 / CVE-2012-4049)(fixed     upstream)

  - Security fixes: o wnpa-sec-2012-13 The DCP ETSI     dissector could trigger a zero division. Reported by     Laurent Butti. (Bug 7566) o wnpa-sec-2012-15 The XTP     dissector could go into an infinite loop. Reported by     Ben Schmidt. (Bug 7571) o wnpa-sec-2012-17 The AFP     dissector could go into a large loop. Reported by Stefan     Cornelius. (Bug 7603) o wnpa-sec-2012-18 The RTPS2     dissector could overflow a buffer. Reported by Laurent     Butti. (Bug 7568) o wnpa-sec-2012-20 The CIP dissector     could exhaust system memory. Reported y Ben Schmidt.
    (Bug 7570) o wnpa-sec-2012-21 The STUN dissector could     crash. Reported by Laurent Butti. (Bug 7569) o     wnpa-sec-2012-22 The EtherCAT Mailbox dissector could     abort. Reported by Laurent Butti. (Bug 7562) o     wnpa-sec-2012-23 The CTDB dissector could go into a     large loop. Reported by Ben Schmidt. (Bug 7573)

  - Bug fixes: o Wireshark crashes on opening very short NFS     pcap file. (Bug 7498)

  - Updated Protocol Support o AFP, Bluetooth L2CAP, CIP,     CTDB, DCP ETSI, EtherCAT Mailbox, FC Link Control LISP,     NFS, RTPS2, SCTP, STUN, XTP

Multiple vulnerabilities was found and corrected in Wireshark :

It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file (CVE-2012-4048).

It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file (CVE-2012-4049).

This advisory provides the latest versiona of Wireshark (1.4.14, 1.6.8) which is not vulnerable to these issues.

Wireshark reports :

It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

The PPP dissector could crash.

The NFS dissector could use excessive amounts of CPU.

The DCP ETSI dissector could trigger a zero division.

The MongoDB dissector could go into a large loop.

The XTP dissector could go into an infinite loop.

The ERF dissector could overflow a buffer.

The AFP dissector could go into a large loop.

The RTPS2 dissector could overflow a buffer.

The GSM RLC MAC dissector could overflow a buffer.

The CIP dissector could exhaust system memory.

The STUN dissector could crash.

The EtherCAT Mailbox dissector could abort.

The CTDB dissector could go into a large loop.

The pcap-ng file parser could trigger a zero division.

The Ixia IxVeriWave file parser could overflow a buffer.

The installed version of Wireshark is 1.8.x before 1.8.1.  This version is affected by the following vulnerabilities :

  - An error exists in the 'PPP' dissector that can cause     the application to crash when reading a malformed     packet from either the wire or from a capture file.
    (CVE-2012-4048)

  - An error exists in the 'NFS' dissector that can cause     the application to consume excessive CPU resources when     reading a malformed packet from either the wire or from     a capture file. (CVE-2012-4049)

The installed version of Wireshark is 1.6.x before 1.6.9.  This version is affected by the following vulnerabilities :

  - An error exists in the 'PPP' dissector that can cause     the application to crash when reading a malformed     packet from either the wire or from a capture file.
    (CVE-2012-4048)

  - An error exists in the 'NFS' dissector that can cause     the application to consume excessive CPU resources when     reading a malformed packet from either the wire or from     a capture file. (CVE-2012-4049)

The installed version of Wireshark is 1.4.x before 1.4.14.  This version is affected by the following vulnerabilities :

  - An error exists in the 'PPP' dissector that can cause     the application to crash when reading a malformed     packet from either the wire or from a capture file.
    (CVE-2012-4048)

  - An error exists in the 'NFS' dissector that can cause     the application to consume excessive CPU resources when     reading a malformed packet from either the wire or from     a capture file. (CVE-2012-4049)

ID	Name	Product	Family	Severity
80803	Oracle Solaris Third-Party Patch Update : wireshark (multiple_vulnerabilities_in_wireshark1)	Nessus	Solaris Local Security Checks	low
74695	openSUSE Security Update : wireshark (openSUSE-SU-2012:0930-1)	Nessus	SuSE Local Security Checks	low
69500	GLSA-201308-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
66069	Mandriva Linux Security Advisory : wireshark (MDVSA-2013:055)	Nessus	Mandriva Local Security Checks	high
64231	SuSE 11.2 Security Update : wireshark (SAT Patch Number 6760)	Nessus	SuSE Local Security Checks	low
62097	SuSE 10 Security Update : wireshark (ZYPP Patch Number 8267)	Nessus	SuSE Local Security Checks	low
61974	Mandriva Linux Security Advisory : wireshark (MDVSA-2012:125)	Nessus	Mandriva Local Security Checks	low
61588	FreeBSD : Wireshark -- Multiple vulnerabilities (4cdfe875-e8d6-11e1-bea0-002354ed89bc)	Nessus	FreeBSD Local Security Checks	high
60118	Wireshark 1.8.x < 1.8.1 Multiple Denial of Service Vulnerabilities	Nessus	Windows	low
60117	Wireshark 1.6.x < 1.6.9 Multiple Denial of Service Vulnerabilities	Nessus	Windows	low
60116	Wireshark 1.4.x < 1.4.14 Multiple Denial of Service Vulnerabilities	Nessus	Windows	low

Detections

Analytics

CVE-2012-4049

high

Tenable Plugins

low

low

high

high

low

low

low

high

low

low

low