The kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Kernel ASLR Bypass Vulnerability."

The version of Wireshark installed on the remote Windows host is prior to 2.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.0.2 advisory.

  - Untrusted search path vulnerability in the WiresharkApplication class in ui/qt/wireshark_application.cpp     in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 on Windows allows local users to gain privileges     via a Trojan horse riched20.dll.dll file in the current working directory, related to use of QLibrary.
    (CVE-2016-2521)

  - The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector     in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote     attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
    (CVE-2016-2522)

  - The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark     1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service     (infinite loop) via a crafted packet. (CVE-2016-2523)

  - epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the     algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted     packet. (CVE-2016-2524)

  - epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the     amount of header data, which allows remote attackers to cause a denial of service (memory consumption or     application crash) via a crafted packet. (CVE-2016-2525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 2.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.0.2 advisory.

  - Untrusted search path vulnerability in the WiresharkApplication class in ui/qt/wireshark_application.cpp     in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 on Windows allows local users to gain privileges     via a Trojan horse riched20.dll.dll file in the current working directory, related to use of QLibrary.
    (CVE-2016-2521)

  - The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector     in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote     attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
    (CVE-2016-2522)

  - The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark     1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service     (infinite loop) via a crafted packet. (CVE-2016-2523)

  - epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the     algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted     packet. (CVE-2016-2524)

  - epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the     amount of header data, which allows remote attackers to cause a denial of service (memory consumption or     application crash) via a crafted packet. (CVE-2016-2525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists in the     Windows Adobe Type Manager Library due to improper     handling of specially crafted OpenType fonts. An     authenticated, remote attacker can exploit this     vulnerability, via a specially crafted application, to     elevate privileges and execute arbitrary code.
    (CVE-2015-2506)

  - Multiple elevation of privilege vulnerabilities exist in     the Windows Adobe Type Manager Library due to improper     handling of objects in memory. A local attacker can     exploit these vulnerabilities, via a specially crafted     application, to execute arbitrary code. (CVE-2015-2507,     CVE-2015-2508, CVE-2015-2512)

  - A remote code execution vulnerability exists in     components of Windows, Office, and Lync due to improper     handling of specially crafted OpenType fonts. An     unauthenticated, remote attacker can exploit this     vulnerability by convincing a user to open a file or     visit a website containing specially crafted OpenType     fonts, resulting in execution of arbitrary code in the     context of the current user. (CVE-2015-2510)

  - Multiple elevation of privilege vulnerabilities exist in     the Windows kernel-mode driver due to improper handling     of objects in memory. A local attacker can exploit these     vulnerabilities, via a specially crafted application, to     execute arbitrary code in kernel mode. (CVE-2015-2511,     CVE-2015-2517, CVE-2015-2518, CVE-2015-2546)

  - An elevation of privilege vulnerability exists in the     Windows kernel-mode driver due to improper validation     and enforcement of integrity levels during certain     process initialization scenarios. A local attacker can     exploit this vulnerability, via a specially crafted     application, to execute arbitrary code in kernel mode.
    (CVE-2015-2527)

  - A security feature bypass vulnerability exists due to     a failure by the Windows kernel to properly initialize a     memory address. A local attacker can exploit this, via a     specially crafted application, to bypass Kernel Address     Space Layout Randomization (KASLR) and retrieve the base     address of the kernel driver. (CVE-2015-2529)

ID	Name	Product	Family	Type	Severity
89104	Wireshark 2.0.x < 2.0.2 Multiple Vulnerabilities	Nessus	Windows	Local	high
89102	Wireshark 2.0.x < 2.0.2 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	Local	high
85877	MS15-097: Vulnerabilities in Microsoft Graphics Component Could Allow Remote Code Execution (3089656)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2015-2529

high

Tenable Plugins

high

high

high