The dissect_rohc_ir_packet function in epan/dissectors/packet-rohc.c in the ROHC dissector in Wireshark 1.8.x before 1.8.5 does not properly handle unknown profiles, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.

wireshark was updated to 1.8.5 to fix bugs and security issues.

Vulnerabilities fixed :

  - Infinite and large loops in the Bluetooth HCI, CSN.1,     DCP-ETSI DOCSIS CM-STAUS, IEEE 802.3 Slow Protocols,     MPLS, R3, RTPS, SDP, and SIP dissectors wnpa-sec-2013-01     CVE-2013-1572 CVE-2013-1573 CVE-2013-1574 CVE-2013-1575     CVE-2013-1576 CVE-2013-1577 CVE-2013-1578 CVE-2013-1579     CVE-2013-1580 CVE-2013-1581

  - The CLNP dissector could crash wnpa-sec-2013-02     CVE-2013-1582

  - The DTN dissector could crash wnpa-sec-2013-03     CVE-2013-1583 CVE-2013-1584

  - The MS-MMC dissector (and possibly others) could crash     wnpa-sec-2013-04 CVE-2013-1585

  - The DTLS dissector could crash wnpa-sec-2013-05     CVE-2013-1586

  - The ROHC dissector could crash wnpa-sec-2013-06     CVE-2013-1587

  - The DCP-ETSI dissector could corrupt memory     wnpa-sec-2013-07 CVE-2013-1588

  - The Wireshark dissection engine could crash     wnpa-sec-2013-08 CVE-2013-1589

  - The NTLMSSP dissector could overflow a buffer     wnpa-sec-2013-09 CVE-2013-1590

  + Further bug fixes and updated protocol support as listed     in:
    http://www.wireshark.org/docs/relnotes/wireshark-1.8.5.h     tml

wireshark was updated to 1.8.5 (bnc#801131), fixing bugs and security issues :

The following vulnerabilities have been fixed :

  - Infinite and large loops in the Bluetooth HCI, CSN.1,     DCP-ETSI DOCSIS CM-STAUS, IEEE 802.3 Slow Protocols,     MPLS, R3, RTPS, SDP, and SIP dissectors wnpa-sec-2013-01     CVE-2013-1572 / CVE-2013-1573 / CVE-2013-1574 /     CVE-2013-1575 / CVE-2013-1576 / CVE-2013-1577 /     CVE-2013-1578 / CVE-2013-1579 / CVE-2013-1580 /     CVE-2013-1581

  - The CLNP dissector could crash wnpa-sec-2013-02.
    (CVE-2013-1582)

  - The DTN dissector could crash wnpa-sec-2013-03.
    (CVE-2013-1583 / CVE-2013-1584)

  - The MS-MMC dissector (and possibly others) could crash     wnpa-sec-2013-04. (CVE-2013-1585)

  - The DTLS dissector could crash wnpa-sec-2013-05.
    (CVE-2013-1586)

  - The ROHC dissector could crash wnpa-sec-2013-06.
    (CVE-2013-1587)

  - The DCP-ETSI dissector could corrupt memory     wnpa-sec-2013-07. (CVE-2013-1588)

  - The Wireshark dissection engine could crash     wnpa-sec-2013-08. (CVE-2013-1589)

  - The NTLMSSP dissector could overflow a buffer     wnpa-sec-2013-09 CVE-2013-1590: Further bug fixes and     updated protocol support as listed in:
    http://www.wireshark.org/docs/relnotes/wireshark-1.8.5.h     tml

The installed version of Wireshark 1.8 is earlier than 1.8.5.  It is, therefore, affected by the following vulnerabilities :

  - Errors exist related to the Bluetooth HCI, CSN.1,     DCP-ETSI DOCSIS CM-STAUS, IEEE 802.3 Slow Protocols,     MPLS, R3, RTPS, SDP, and SIP dissectors that could     allow the application to enter infinite or large loops,     thereby consuming excessive CPU resources. (Bugs 8036,     8037, 8038, 8040, 8041, 8042, 8043, 8198, 8199, 8222)

  - Errors exist related to the DCP-ETSI, ROHC, DTLS,     MS-MMC, DTN, CLNP dissectors that could allow them to     crash. (Bugs 7679, 7871, 7945, 8111, 8112, 8213)

  - An unspecified error could allow the dissection engine     to crash. (Bug 8197)

  - An unspecified buffer overflow exists in the NTLMSSP     dissector that has an unspecified impact.

ID	Name	Product	Family	Severity
74879	openSUSE Security Update : wireshark (openSUSE-SU-2013:0276-1)	Nessus	SuSE Local Security Checks	low
64796	SuSE 11.2 Security Update : wireshark (SAT Patch Number 7317)	Nessus	SuSE Local Security Checks	low
64795	SuSE 11.2 Security Update : wireshark (SAT Patch Number 7317)	Nessus	SuSE Local Security Checks	low
64362	Wireshark 1.8.x < 1.8.5 Multiple Vulnerabilities	Nessus	Windows	low

Detections

Analytics

CVE-2013-1587

high

Tenable Plugins

low

low

low

low