The dissect_mpls_echo_tlv_dd_map function in epan/dissectors/packet-mpls-echo.c in the MPLS Echo dissector in Wireshark 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (infinite loop) via invalid Sub-tlv data.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.8.6. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.8.6 advisory.

  - The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment     offset before invoking the reassembly state machine, which allows remote attackers to cause a denial of     service (application crash) via a large offset value that triggers write access to an invalid memory     location. (CVE-2013-2488)

  - epan/dissectors/packet-reload.c in the REsource LOcation And Discovery (aka RELOAD) dissector in Wireshark     1.8.x before 1.8.6 uses incorrect integer data types, which allows remote attackers to cause a denial of     service (infinite loop) via crafted integer values in a packet, related to the (1) dissect_icecandidates,     (2) dissect_kinddata, (3) dissect_nodeid_list, (4) dissect_storeans, (5) dissect_storereq, (6)     dissect_storeddataspecifier, (7) dissect_fetchreq, (8) dissect_findans, (9) dissect_diagnosticinfo, (10)     dissect_diagnosticresponse, (11) dissect_reload_messagecontents, and (12) dissect_reload_message     functions, a different vulnerability than CVE-2013-2486. (CVE-2013-2487)

  - The TCP dissector in Wireshark 1.8.x before 1.8.6 allows remote attackers to cause a denial of service     (application crash) via a malformed packet. (CVE-2013-2475)

  - The dissect_hartip function in epan/dissectors/packet-hartip.c in the HART/IP dissector in Wireshark 1.8.x     before 1.8.6 allows remote attackers to cause a denial of service (infinite loop) via a packet with a     header that is too short. (CVE-2013-2476)

  - The CSN.1 dissector in Wireshark 1.8.x before 1.8.6 does not properly manage function pointers, which     allows remote attackers to cause a denial of service (application crash) via a malformed packet.
    (CVE-2013-2477)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered in the dissectors/parsers for PKTC, IAX2, GSM CBCH and NCP which could result in denial of service.

This update also fixes many older less important issues by updating the package to the version found in Debian 8 also known as Jessie.

For Debian 7 'Wheezy', these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u6~deb7u1.

We recommend that you upgrade your wireshark packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

wireshark was updated to 1.8.6 [bnc#807942]

  + vulnerabilities fixed :

  - The TCP dissector could crash. wnpa-sec-2013-10     CVE-2013-2475

  - The HART/IP dissectory could go into an infinite loop.
    wnpa-sec-2013-11 CVE-2013-2476

  - The CSN.1 dissector could crash. wnpa-sec-2013-12     CVE-2013-2477

  - The MS-MMS dissector could crash. wnpa-sec-2013-13     CVE-2013-2478

  - The MPLS Echo dissector could go into an infinite loop.
    wnpa-sec-2013-14 CVE-2013-2479

  - The RTPS and RTPS2 dissectors could crash.
    wnpa-sec-2013-15 CVE-2013-2480

  - The Mount dissector could crash. wnpa-sec-2013-16     CVE-2013-2481

  - The AMPQ dissector could go into an infinite loop.
    wnpa-sec-2013-17 CVE-2013-2482

  - The ACN dissector could attempt to divide by zero.
    wnpa-sec-2013-18 CVE-2013-2483

  - The CIMD dissector could crash. wnpa-sec-2013-19     CVE-2013-2484

  - The FCSP dissector could go into an infinite loop.
    wnpa-sec-2013-20 CVE-2013-2485

  - The RELOAD dissector could go into an infinite loop.
    wnpa-sec-2013-21 CVE-2013-2486 CVE-2013-2487

  - The DTLS dissector could crash. wnpa-sec-2013-22     CVE-2013-2488 

  + Further bug fixes and updated protocol support as listed     in:
    http://www.wireshark.org/docs/relnotes/wireshark-1.8.6.h     tml

wireshark has been updated to 1.6.14 to fix bugs and security issues :

Vulnerabilities fixed :

  - The sFlow dissector could go into an infinite loop.
    wnpa-sec-2012-32 CVE-2012-6054: * The SCTP dissector     could go into an infinite loop. wnpa-sec-2012-33     CVE-2012-6056: * The MS-MMS dissector could crash.
    wnpa-sec-2013-13 CVE-2013-2478

  - The RTPS and RTPS2 dissectors could crash.
    wnpa-sec-2013-15 CVE-2013-2480: * The Mount dissector     could crash. wnpa-sec-2013-16 CVE-2013-2481

  - The AMPQ dissector could go into an infinite loop.
    wnpa-sec-2013-17 CVE-2013-2482: * The ACN dissector     could attempt to divide by zero. wnpa-sec-2013-18     CVE-2013-2483: * The CIMD dissector could crash.
    wnpa-sec-2013-19 CVE-2013-2484

  - The FCSP dissector could go into an infinite loop.
    wnpa-sec-2013-20 CVE-2013-2485: * The DTLS dissector     could crash. wnpa-sec-2013-22 CVE-2013-2488

Further bug fixes and updated protocol support are listed in :

http://www.wireshark.org/docs/relnotes/wireshark-1.6.14.html

wireshark has been updated to 1.8.6 which fixes bugs and security issues :

Vulnerabilities fixed :

  - The TCP dissector could crash. wnpa-sec-2013-10.
    (CVE-2013-2475)

  - The HART/IP dissectory could go into an infinite loop.
    wnpa-sec-2013-11. (CVE-2013-2476)

  - The CSN.1 dissector could crash. wnpa-sec-2013-12.
    (CVE-2013-2477)

  - The MS-MMS dissector could crash. wnpa-sec-2013-13.
    (CVE-2013-2478)

  - The MPLS Echo dissector could go into an infinite loop.
    wnpa-sec-2013-14. (CVE-2013-2479)

  - The RTPS and RTPS2 dissectors could crash.
    wnpa-sec-2013-15. (CVE-2013-2480)

  - The Mount dissector could crash. wnpa-sec-2013-16.
    (CVE-2013-2481)

  - The AMPQ dissector could go into an infinite loop.
    wnpa-sec-2013-17. (CVE-2013-2482)

  - The ACN dissector could attempt to divide by zero.
    wnpa-sec-2013-18. (CVE-2013-2483)

  - The CIMD dissector could crash. wnpa-sec-2013-19.
    (CVE-2013-2484)

  - The FCSP dissector could go into an infinite loop.
    wnpa-sec-2013-20. (CVE-2013-2485)

  - The RELOAD dissector could go into an infinite loop.
    wnpa-sec-2013-21. (CVE-2013-2486 / CVE-2013-2487)

  - The DTLS dissector could crash. wnpa-sec-2013-22     (CVE-2013-2488) More information about further bug fixes     and updated protocol support are listed here:
    http://www.wireshark.org/docs/relnotes/wireshark-1.8.6.h     tml

The version of Wireshark installed on the remote Windows host is prior to 1.8.6. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.8.6 advisory.

  - The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment     offset before invoking the reassembly state machine, which allows remote attackers to cause a denial of     service (application crash) via a large offset value that triggers write access to an invalid memory     location. (CVE-2013-2488)

  - epan/dissectors/packet-reload.c in the REsource LOcation And Discovery (aka RELOAD) dissector in Wireshark     1.8.x before 1.8.6 uses incorrect integer data types, which allows remote attackers to cause a denial of     service (infinite loop) via crafted integer values in a packet, related to the (1) dissect_icecandidates,     (2) dissect_kinddata, (3) dissect_nodeid_list, (4) dissect_storeans, (5) dissect_storereq, (6)     dissect_storeddataspecifier, (7) dissect_fetchreq, (8) dissect_findans, (9) dissect_diagnosticinfo, (10)     dissect_diagnosticresponse, (11) dissect_reload_messagecontents, and (12) dissect_reload_message     functions, a different vulnerability than CVE-2013-2486. (CVE-2013-2487)

  - The TCP dissector in Wireshark 1.8.x before 1.8.6 allows remote attackers to cause a denial of service     (application crash) via a malformed packet. (CVE-2013-2475)

  - The dissect_hartip function in epan/dissectors/packet-hartip.c in the HART/IP dissector in Wireshark 1.8.x     before 1.8.6 allows remote attackers to cause a denial of service (infinite loop) via a packet with a     header that is too short. (CVE-2013-2476)

  - The CSN.1 dissector in Wireshark 1.8.x before 1.8.6 does not properly manage function pointers, which     allows remote attackers to cause a denial of service (application crash) via a malformed packet.
    (CVE-2013-2477)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
364160	Wireshark 1.8.x < 1.8.6 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	Local	high
91395	Debian DLA-497-1 : wireshark security update	Nessus	Debian Local Security Checks	Local	medium
74930	openSUSE Security Update : wireshark (openSUSE-SU-2013:0494-1)	Nessus	SuSE Local Security Checks	Local	high
66255	SuSE 10 Security Update : wireshark (ZYPP Patch Number 8500)	Nessus	SuSE Local Security Checks	Local	high
66254	SuSE 11.2 Security Update : wireshark (SAT Patch Number 7490)	Nessus	SuSE Local Security Checks	Local	high
65254	Wireshark 1.8.x < 1.8.6 Multiple Vulnerabilities	Nessus	Windows	Local	high

Detections

Analytics

CVE-2013-2479

high

Tenable Plugins

high

medium

high

high

high

high