The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment offset before invoking the reassembly state machine, which allows remote attackers to cause a denial of service (application crash) via a large offset value that triggers write access to an invalid memory location.

wireshark was updated to 1.8.6 [bnc#807942]

  + vulnerabilities fixed :

  - The TCP dissector could crash. wnpa-sec-2013-10     CVE-2013-2475

  - The HART/IP dissectory could go into an infinite loop.
    wnpa-sec-2013-11 CVE-2013-2476

  - The CSN.1 dissector could crash. wnpa-sec-2013-12     CVE-2013-2477

  - The MS-MMS dissector could crash. wnpa-sec-2013-13     CVE-2013-2478

  - The MPLS Echo dissector could go into an infinite loop.
    wnpa-sec-2013-14 CVE-2013-2479

  - The RTPS and RTPS2 dissectors could crash.
    wnpa-sec-2013-15 CVE-2013-2480

  - The Mount dissector could crash. wnpa-sec-2013-16     CVE-2013-2481

  - The AMPQ dissector could go into an infinite loop.
    wnpa-sec-2013-17 CVE-2013-2482

  - The ACN dissector could attempt to divide by zero.
    wnpa-sec-2013-18 CVE-2013-2483

  - The CIMD dissector could crash. wnpa-sec-2013-19     CVE-2013-2484

  - The FCSP dissector could go into an infinite loop.
    wnpa-sec-2013-20 CVE-2013-2485

  - The RELOAD dissector could go into an infinite loop.
    wnpa-sec-2013-21 CVE-2013-2486 CVE-2013-2487

  - The DTLS dissector could crash. wnpa-sec-2013-22     CVE-2013-2488 

  + Further bug fixes and updated protocol support as listed     in:
    http://www.wireshark.org/docs/relnotes/wireshark-1.8.6.h     tml

wireshark has been updated to 1.6.14 to fix bugs and security issues :

Vulnerabilities fixed :

  - The sFlow dissector could go into an infinite loop.
    wnpa-sec-2012-32 CVE-2012-6054: * The SCTP dissector     could go into an infinite loop. wnpa-sec-2012-33     CVE-2012-6056: * The MS-MMS dissector could crash.
    wnpa-sec-2013-13 CVE-2013-2478

  - The RTPS and RTPS2 dissectors could crash.
    wnpa-sec-2013-15 CVE-2013-2480: * The Mount dissector     could crash. wnpa-sec-2013-16 CVE-2013-2481

  - The AMPQ dissector could go into an infinite loop.
    wnpa-sec-2013-17 CVE-2013-2482: * The ACN dissector     could attempt to divide by zero. wnpa-sec-2013-18     CVE-2013-2483: * The CIMD dissector could crash.
    wnpa-sec-2013-19 CVE-2013-2484

  - The FCSP dissector could go into an infinite loop.
    wnpa-sec-2013-20 CVE-2013-2485: * The DTLS dissector     could crash. wnpa-sec-2013-22 CVE-2013-2488

Further bug fixes and updated protocol support are listed in :

http://www.wireshark.org/docs/relnotes/wireshark-1.6.14.html

wireshark has been updated to 1.8.6 which fixes bugs and security issues :

Vulnerabilities fixed :

  - The TCP dissector could crash. wnpa-sec-2013-10.
    (CVE-2013-2475)

  - The HART/IP dissectory could go into an infinite loop.
    wnpa-sec-2013-11. (CVE-2013-2476)

  - The CSN.1 dissector could crash. wnpa-sec-2013-12.
    (CVE-2013-2477)

  - The MS-MMS dissector could crash. wnpa-sec-2013-13.
    (CVE-2013-2478)

  - The MPLS Echo dissector could go into an infinite loop.
    wnpa-sec-2013-14. (CVE-2013-2479)

  - The RTPS and RTPS2 dissectors could crash.
    wnpa-sec-2013-15. (CVE-2013-2480)

  - The Mount dissector could crash. wnpa-sec-2013-16.
    (CVE-2013-2481)

  - The AMPQ dissector could go into an infinite loop.
    wnpa-sec-2013-17. (CVE-2013-2482)

  - The ACN dissector could attempt to divide by zero.
    wnpa-sec-2013-18. (CVE-2013-2483)

  - The CIMD dissector could crash. wnpa-sec-2013-19.
    (CVE-2013-2484)

  - The FCSP dissector could go into an infinite loop.
    wnpa-sec-2013-20. (CVE-2013-2485)

  - The RELOAD dissector could go into an infinite loop.
    wnpa-sec-2013-21. (CVE-2013-2486 / CVE-2013-2487)

  - The DTLS dissector could crash. wnpa-sec-2013-22     (CVE-2013-2488) More information about further bug fixes     and updated protocol support are listed here:
    http://www.wireshark.org/docs/relnotes/wireshark-1.8.6.h     tml

Multiple vulnerabilities has been found and corrected in wireshark :

Infinite and large loops in ANSI MAP, BACapp, Bluetooth HCI, IEEE 802.3, LTP, and R3 dissectors have been fixed. Discovered by Laurent Butti (http://www.wireshark.org/security/wnpa-sec-2012-08.html [CVE-2012-2392])

The DIAMETER dissector could try to allocate memory improperly and crash (http://www.wireshark.org/security/wnpa-sec-2012-09.html [CVE-2012-2393])

Wireshark could crash on SPARC processors due to misaligned memory.
Discovered by Klaus Heckelmann (http://www.wireshark.org/security/wnpa-sec-2012-10.html [CVE-2012-2394])

The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted packet, as demonstrated by a usbmon dump (CVE-2012-4048).

epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet (CVE-2012-4049).

The DCP ETSI dissector could trigger a zero division (CVE-2012-4285).

The XTP dissector could go into an infinite loop (CVE-2012-4288).

The AFP dissector could go into a large loop (CVE-2012-4289).

The RTPS2 dissector could overflow a buffer (CVE-2012-4296).

The GSM RLC MAC dissector could overflow a buffer (CVE-2012-4297).

The CIP dissector could exhaust system memory (CVE-2012-4291).

The STUN dissector could crash (CVE-2012-4292).

The EtherCAT Mailbox dissector could abort (CVE-2012-4293).

The CTDB dissector could go into a large loop (CVE-2012-4290).

Martin Wilck discovered an infinite loop in the DRDA dissector (CVE-2012-5239).

The USB dissector could go into an infinite loop. (wnpa-sec-2012-31)

The ISAKMP dissector could crash. (wnpa-sec-2012-35)

The iSCSI dissector could go into an infinite loop. (wnpa-sec-2012-36)

The WTP dissector could go into an infinite loop. (wnpa-sec-2012-37)

The RTCP dissector could go into an infinite loop. (wnpa-sec-2012-38)

The ICMPv6 dissector could go into an infinite loop.
(wnpa-sec-2012-40)

Infinite and large loops in the Bluetooth HCI, CSN.1, DCP-ETSI DOCSIS CM-STAUS, IEEE 802.3 Slow Protocols, MPLS, R3, RTPS, SDP, and SIP dissectors (wnpa-sec-2013-01).

The CLNP dissector could crash (wnpa-sec-2013-02).

The DTN dissector could crash (wnpa-sec-2013-03).

The MS-MMC dissector (and possibly others) could crash (wnpa-sec-2013-04).

The DTLS dissector could crash (wnpa-sec-2013-05).

The DCP-ETSI dissector could corrupt memory (wnpa-sec-2013-07).

The Wireshark dissection engine could crash (wnpa-sec-2013-08).

The NTLMSSP dissector could overflow a buffer (wnpa-sec-2013-09).

The sFlow dissector could go into an infinite loop (CVE-2012-6054).

The SCTP dissector could go into an infinite loop (CVE-2012-6056).

The MS-MMS dissector could crash (CVE-2013-2478).

The RTPS and RTPS2 dissectors could crash (CVE-2013-2480).

The Mount dissector could crash (CVE-2013-2481).

The AMPQ dissector could go into an infinite loop (CVE-2013-2482).

The ACN dissector could attempt to divide by zero (CVE-2013-2483).

The CIMD dissector could crash (CVE-2013-2484).

The FCSP dissector could go into an infinite loop (CVE-2013-2485).

The DTLS dissector could crash (CVE-2013-2488).

This advisory provides the latest version of Wireshark (1.6.14) which is not vulnerable to these issues.

Multiple vulnerabilities were discovered in the dissectors for the MS-MMS, RTPS, RTPS2, Mount, ACN, CIMD and DTLS protocols, which could result in denial of service or the execution of arbitrary code.

The installed version of Wireshark 1.8 is earlier than 1.8.6.  It is, therefore, affected by the following vulnerabilities :

  - Errors exist in the CSN.1, CIMD, DTLS, Mount, MS-MMS,     RTPS, RTPS2, and TCP dissectors that could allow them     to crash. (Bugs 8274, 8332, 8335, 8346, 8380, 8382)

  - Errors exist in the AMPQ, FCSP, HART/IP, MPLS Echo,     and RELOAD dissectors that could lead to an infinite     loop, resulting in a denial of service. (Bugs 8039,     8337, 8359, 8360, 8364)

  - The ACN dissector can attempt a divide by zero     operation that could lead to an application crash.
    (Bug 8340)

The installed version of Wireshark 1.6 is earlier than 1.6.14.  It is, therefore, affected by the following vulnerabilities :

  - Errors exist in the FCSP, AMPQ, SCTP, and sFlow     dissector that could lead to an infinite loop resulting     in a denial of service. (Bugs 7789, 7802, 8337, 8359)

  - Errors exist in the CIMD, DTLS, Mount, MS-MMS, RTPS,     and RTPS2 that could allow them to crash.
    (Bugs 8382, 8332, 8335, 8346, 8380)

  - The ACN dissector can attempt a divide by zero     operation that could lead to an application crash.
    (Bug 8340)

ID	Name	Product	Family	Severity
74930	openSUSE Security Update : wireshark (openSUSE-SU-2013:0494-1)	Nessus	SuSE Local Security Checks	high
66255	SuSE 10 Security Update : wireshark (ZYPP Patch Number 8500)	Nessus	SuSE Local Security Checks	high
66254	SuSE 11.2 Security Update : wireshark (SAT Patch Number 7490)	Nessus	SuSE Local Security Checks	high
66069	Mandriva Linux Security Advisory : wireshark (MDVSA-2013:055)	Nessus	Mandriva Local Security Checks	high
65557	Debian DSA-2644-1 : wireshark - several vulnerabilities	Nessus	Debian Local Security Checks	medium
65254	Wireshark 1.8.x < 1.8.6 Multiple Vulnerabilities	Nessus	Windows	high
65253	Wireshark 1.6.x < 1.6.14 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2013-2488

high

Tenable Plugins

high

high

high

high

medium

high

medium