The dissect_atn_cpdlc_heur function in asn1/atn-cpdlc/packet-atn-cpdlc-template.c in the ATN-CPDLC dissector in Wireshark 1.12.x before 1.12.4 does not properly follow the TRY/ENDTRY code requirements, which allows remote attackers to cause a denial of service (stack memory corruption and application crash) via a crafted packet.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.12.4. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.12.4 advisory.

  - Integer overflow in the dissect_osd2_cdb_continuation function in epan/dissectors/packet-scsi-osd.c in the     SCSI OSD dissector in Wireshark 1.12.x before 1.12.4 allows remote attackers to cause a denial of service     (infinite loop) via a crafted length field in a packet. (CVE-2015-2192)

  - The dissect_atn_cpdlc_heur function in asn1/atn-cpdlc/packet-atn-cpdlc-template.c in the ATN-CPDLC     dissector in Wireshark 1.12.x before 1.12.4 does not properly follow the TRY/ENDTRY code requirements,     which allows remote attackers to cause a denial of service (stack memory corruption and application crash)     via a crafted packet. (CVE-2015-2187)

  - epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before     1.12.4 does not properly initialize a data structure, which allows remote attackers to cause a denial of     service (out-of-bounds read and application crash) via a crafted packet that is improperly handled during     decompression. (CVE-2015-2188)

  - Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark     1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-     of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a     crafted packet. (CVE-2015-2189)

  - epan/proto.c in Wireshark 1.12.x before 1.12.4 does not properly handle integer data types greater than 32     bits in size, which allows remote attackers to cause a denial of service (assertion failure and     application exit) via a crafted packet that is improperly handled by the LLDP dissector. (CVE-2015-2190)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201510-03 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Wireshark was updated to 1.10.13 on openSUSE 13.1 to fix bugs and security issues. Wireshark was updated to 1.12.4 on openSUSE 13.2 to fix bugs and security issues.

The following security issues were fixed in 1.10.13 :

  - The WCP dissector could crash. wnpa-sec-2015-07     CVE-2015-2188 [bnc#920696]

  - The pcapng file parser could crash. wnpa-sec-2015-08     CVE-2015-2189 [bnc#920697]

  - The TNEF dissector could go into an infinite loop.
    wnpa-sec-2015-10 CVE-2015-2191 [bnc#920699]

  - Further bug fixes and updated protocol support as listed     in:
    https://www.wireshark.org/docs/relnotes/wireshark-1.10.1     3.html

The following security issues were fixed in 1.12.4 :

  - The following security issues were fixed :

  - The ATN-CPDLC dissector could crash. wnpa-sec-2015-06     CVE-2015-2187 [bnc#920695]

  - The WCP dissector could crash. wnpa-sec-2015-07     CVE-2015-2188 [bnc#920696]

  - The pcapng file parser could crash. wnpa-sec-2015-08     CVE-2015-2189 [bnc#920697]

  - The LLDP dissector could crash. wnpa-sec-2015-09     CVE-2015-2190 [bnc#920698]

  - The TNEF dissector could go into an infinite loop.
    wnpa-sec-2015-10 CVE-2015-2191 [bnc#920699]

  - The SCSI OSD dissector could go into an infinite loop.
    wnpa-sec-2015-11 CVE-2015-2192 [bnc#920700]

  - Further bug fixes and updated protocol support as listed     in:
    https://www.wireshark.org/docs/relnotes/wireshark-1.12.4     .html

The version of Wireshark installed on the remote Windows host is prior to 1.12.4. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.12.4 advisory.

  - Integer overflow in the dissect_osd2_cdb_continuation function in epan/dissectors/packet-scsi-osd.c in the     SCSI OSD dissector in Wireshark 1.12.x before 1.12.4 allows remote attackers to cause a denial of service     (infinite loop) via a crafted length field in a packet. (CVE-2015-2192)

  - The dissect_atn_cpdlc_heur function in asn1/atn-cpdlc/packet-atn-cpdlc-template.c in the ATN-CPDLC     dissector in Wireshark 1.12.x before 1.12.4 does not properly follow the TRY/ENDTRY code requirements,     which allows remote attackers to cause a denial of service (stack memory corruption and application crash)     via a crafted packet. (CVE-2015-2187)

  - epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before     1.12.4 does not properly initialize a data structure, which allows remote attackers to cause a denial of     service (out-of-bounds read and application crash) via a crafted packet that is improperly handled during     decompression. (CVE-2015-2188)

  - Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark     1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-     of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a     crafted packet. (CVE-2015-2189)

  - epan/proto.c in Wireshark 1.12.x before 1.12.4 does not properly handle integer data types greater than 32     bits in size, which allows remote attackers to cause a denial of service (assertion failure and     application exit) via a crafted packet that is improperly handled by the LLDP dissector. (CVE-2015-2190)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
369280	Wireshark 1.12.x < 1.12.4 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	Local	high
86688	GLSA-201510-03 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	medium
81869	openSUSE Security Update : wireshark (openSUSE-2015-226)	Nessus	SuSE Local Security Checks	Local	medium
81672	Wireshark 1.12.x < 1.12.4 Multiple Vulnerabilities	Nessus	Windows	Local	high

Detections

Analytics

CVE-2015-2187

high

Tenable Plugins

high

medium

medium

high