epan/dissectors/packet-gsm_a_dtap.c in the GSM DTAP dissector in Wireshark 1.12.x before 1.12.6 does not properly validate digit characters, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the de_emerg_num_list and de_bcd_num functions.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.12.6. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.12.6 advisory.

  - epan/dissectors/packet-gsm_a_dtap.c in the GSM DTAP dissector in Wireshark 1.12.x before 1.12.6 does not     properly validate digit characters, which allows remote attackers to cause a denial of service     (application crash) via a crafted packet, related to the de_emerg_num_list and de_bcd_num functions.
    (CVE-2015-4652)

  - The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in     Wireshark 1.12.x before 1.12.6 does not properly determine whether enough memory is available for storing     IP address strings, which allows remote attackers to cause a denial of service (application crash) via a     crafted packet. (CVE-2015-4651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201510-03 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Wireshark has been updated to 1.12.7. (FATE#319388)

The following vulnerabilities have been fixed :

  - Wireshark could crash when adding an item to the     protocol tree. wnpa-sec-2015-21 CVE-2015-6241

  - Wireshark could attempt to free invalid memory.
    wnpa-sec-2015-22 CVE-2015-6242

  - Wireshark could crash when searching for a protocol     dissector. wnpa-sec-2015-23 CVE-2015-6243

  - The ZigBee dissector could crash. wnpa-sec-2015-24     CVE-2015-6244

  - The GSM RLC/MAC dissector could go into an infinite     loop. wnpa-sec-2015-25 CVE-2015-6245

  - The WaveAgent dissector could crash. wnpa-sec-2015-26     CVE-2015-6246

  - The OpenFlow dissector could go into an infinite loop.
    wnpa-sec-2015-27 CVE-2015-6247

  - Wireshark could crash due to invalid ptvcursor length     checking. wnpa-sec-2015-28 CVE-2015-6248

  - The WCCP dissector could crash. wnpa-sec-2015-29     CVE-2015-6249

  - Further bug fixes and updated protocol support as listed     in:
    https://www.wireshark.org/docs/relnotes/wireshark-1.12.7     .html

Also a fix from 1.12.6 in GSM DTAP was backported. (bnc#935158 CVE-2015-4652)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Wireshark was updated to 1.12.6 to fix two security issues.

The following vulnerabilities were fixed :

  - CVE-2015-4651: The WCCP dissector crashed when reading     specially crafted packages from the network or a capture     files (wnpa-sec-2015-19, boo#935157).

  - CVE-2015-4652: The GSM DTAP dissector crashed when     reading specially crafted packages from the network or a     capture file (wnpa-sec-2015-20, boo#935158).

This update also contains further bug fixes and updated protocol support as listed in:
https://www.wireshark.org/docs/relnotes/wireshark-1.12.6.html

The version of Wireshark installed on the remote Windows host is prior to 1.12.6. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.12.6 advisory.

  - epan/dissectors/packet-gsm_a_dtap.c in the GSM DTAP dissector in Wireshark 1.12.x before 1.12.6 does not     properly validate digit characters, which allows remote attackers to cause a denial of service     (application crash) via a crafted packet, related to the de_emerg_num_list and de_bcd_num functions.
    (CVE-2015-4652)

  - The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in     Wireshark 1.12.x before 1.12.6 does not properly determine whether enough memory is available for storing     IP address strings, which allows remote attackers to cause a denial of service (application crash) via a     crafted packet. (CVE-2015-4651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered in the dissectors for WCCP and GSM DTAP, which could result in denial of service.

The oldstable distribution (wheezy) is not affected.

ID	Name	Product	Family	Type	Severity
364287	Wireshark 1.12.x < 1.12.6 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	Local	high
86688	GLSA-201510-03 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	medium
86289	SUSE SLED11 Security Update : wireshark (SUSE-SU-2015:1676-2)	Nessus	SuSE Local Security Checks	Local	medium
86288	SUSE SLES11 Security Update : wireshark (SUSE-SU-2015:1676-1)	Nessus	SuSE Local Security Checks	Local	medium
84657	openSUSE Security Update : wireshark (openSUSE-2015-478)	Nessus	SuSE Local Security Checks	Local	medium
84398	Wireshark 1.12.x < 1.12.6 Multiple Vulnerabilities	Nessus	Windows	Local	high
84350	Debian DSA-3294-1 : wireshark - security update	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2015-4652

high

Tenable Plugins

high

medium

medium

medium

medium

high

medium