epan/dissectors/packet-gsm_a_dtap.c in the GSM DTAP dissector in Wireshark 1.12.x before 1.12.6 does not properly validate digit characters, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the de_emerg_num_list and de_bcd_num functions.

The remote host is affected by the vulnerability described in GLSA-201510-03 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Wireshark has been updated to 1.12.7. (FATE#319388)

The following vulnerabilities have been fixed :

  - Wireshark could crash when adding an item to the     protocol tree. wnpa-sec-2015-21 CVE-2015-6241

  - Wireshark could attempt to free invalid memory.
    wnpa-sec-2015-22 CVE-2015-6242

  - Wireshark could crash when searching for a protocol     dissector. wnpa-sec-2015-23 CVE-2015-6243

  - The ZigBee dissector could crash. wnpa-sec-2015-24     CVE-2015-6244

  - The GSM RLC/MAC dissector could go into an infinite     loop. wnpa-sec-2015-25 CVE-2015-6245

  - The WaveAgent dissector could crash. wnpa-sec-2015-26     CVE-2015-6246

  - The OpenFlow dissector could go into an infinite loop.
    wnpa-sec-2015-27 CVE-2015-6247

  - Wireshark could crash due to invalid ptvcursor length     checking. wnpa-sec-2015-28 CVE-2015-6248

  - The WCCP dissector could crash. wnpa-sec-2015-29     CVE-2015-6249

  - Further bug fixes and updated protocol support as listed     in:
    https://www.wireshark.org/docs/relnotes/wireshark-1.12.7     .html

Also a fix from 1.12.6 in GSM DTAP was backported. (bnc#935158 CVE-2015-4652)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Wireshark was updated to 1.12.6 to fix two security issues.

The following vulnerabilities were fixed :

  - CVE-2015-4651: The WCCP dissector crashed when reading     specially crafted packages from the network or a capture     files (wnpa-sec-2015-19, boo#935157).

  - CVE-2015-4652: The GSM DTAP dissector crashed when     reading specially crafted packages from the network or a     capture file (wnpa-sec-2015-20, boo#935158).

This update also contains further bug fixes and updated protocol support as listed in:
https://www.wireshark.org/docs/relnotes/wireshark-1.12.6.html

The version of Wireshark installed on the remote Windows host is 1.12.x prior to 1.12.6. It is, therefore, affected by multiple denial of service vulnerabilities :

  - An unspecified flaw exists in the WCCP dissector. A     remote attacker can exploit this flaw, by injecting a     specially crafted packet or by convincing a user to open     a malformed PCAP file, to crash the application.
    (CVE-2015-4651)

  - An unspecified flaw exists in the GSM DTAP dissector. A     remote attacker can exploit this flaw, by injecting a     specially crafted packet or by convincing a user to open     a malformed PCAP file, to crash the application.
    (CVE-2015-4652)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered in the dissectors for WCCP and GSM DTAP, which could result in denial of service.

The oldstable distribution (wheezy) is not affected.

ID	Name	Product	Family	Severity
86688	GLSA-201510-03 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
86289	SUSE SLED11 Security Update : wireshark (SUSE-SU-2015:1676-2)	Nessus	SuSE Local Security Checks	medium
86288	SUSE SLES11 Security Update : wireshark (SUSE-SU-2015:1676-1)	Nessus	SuSE Local Security Checks	medium
84657	openSUSE Security Update : wireshark (openSUSE-2015-478)	Nessus	SuSE Local Security Checks	medium
84398	Wireshark 1.12.x < 1.12.6 Multiple DoS Vulnerabilities	Nessus	Windows	medium
84350	Debian DSA-3294-1 : wireshark - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-4652

high

Tenable Plugins

medium

medium

medium

medium

medium

medium