The pcapng_read_if_descr_block function in wiretap/pcapng.c in the pcapng parser in Wireshark 1.12.x before 1.12.8 uses too many levels of pointer indirection, which allows remote attackers to cause a denial of service (incorrect free and application crash) via a crafted packet that triggers interface-filter copying.

Multiple vulnerabilities were discovered in the dissectors/parsers for Pcapng, NBAP, UMTS FP, DCOM, AllJoyn, T.38, SDP, NLM, DNS, BED, SCTP, 802.11, DIAMETER, VeriWave, RVSP, ANSi A, GSM A, Ascend, NBAP, ZigBee ZCL and Sniffer which could result in denial of service.

This update contains Wireshark 1.12.9 and fixes the following issues :

  - CVE-2015-7830: pcapng file parser could crash while     copying an interface filter (bsc#950437)

  - CVE-2015-8711: epan/dissectors/packet-nbap.c in the NBAP     dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x     before 2.0.1 does not validate conversation data, which     allows remote attackers to cause a denial of service     (NULL pointer dereference and application crash) via a     crafted packet.

  - CVE-2015-8712: The dissect_hsdsch_channel_info function     in epan/dissectors/packet-umts_fp.c in the UMTS FP     dissector in Wireshark 1.12.x before 1.12.9 does not     validate the number of PDUs, which allows remote     attackers to cause a denial of service (application     crash) via a crafted packet.

  - CVE-2015-8713: epan/dissectors/packet-umts_fp.c in the     UMTS FP dissector in Wireshark 1.12.x before 1.12.9 does     not properly reserve memory for channel ID mappings,     which allows remote attackers to cause a denial of     service (out-of-bounds memory access and application     crash) via a crafted packet.

  - CVE-2015-8714: The dissect_dcom_OBJREF function in     epan/dissectors/packet-dcom.c in the DCOM dissector in     Wireshark 1.12.x before 1.12.9 does not initialize a     certain IPv4 data structure, which allows remote     attackers to cause a denial of service (application     crash) via a crafted packet.

  - CVE-2015-8715: epan/dissectors/packet-alljoyn.c in the     AllJoyn dissector in Wireshark 1.12.x before 1.12.9 does     not check for empty arguments, which allows remote     attackers to cause a denial of service (infinite loop)     via a crafted packet.

  - CVE-2015-8716: The init_t38_info_conv function in     epan/dissectors/packet-t38.c in the T.38 dissector in     Wireshark 1.12.x before 1.12.9 does not ensure that a     conversation exists, which allows remote attackers to     cause a denial of service (application crash) via a     crafted packet.

  - CVE-2015-8717: The dissect_sdp function in     epan/dissectors/packet-sdp.c in the SDP dissector in     Wireshark 1.12.x before 1.12.9 does not prevent use of a     negative media count, which allows remote attackers to     cause a denial of service (application crash) via a     crafted packet.

  - CVE-2015-8718: Double free vulnerability in     epan/dissectors/packet-nlm.c in the NLM dissector in     Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1,     when the 'Match MSG/RES packets for async NLM' option is     enabled, allows remote attackers to cause a denial of     service (application crash) via a crafted packet.

  - CVE-2015-8719: The dissect_dns_answer function in     epan/dissectors/packet-dns.c in the DNS dissector in     Wireshark 1.12.x before 1.12.9 mishandles the EDNS0     Client Subnet option, which allows remote attackers to     cause a denial of service (application crash) via a     crafted packet.

  - CVE-2015-8720: The dissect_ber_GeneralizedTime function     in epan/dissectors/packet-ber.c in the BER dissector in     Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1     improperly checks an sscanf return value, which allows     remote attackers to cause a denial of service     (application crash) via a crafted packet.

  - CVE-2015-8721: Buffer overflow in the tvb_uncompress     function in epan/tvbuff_zlib.c in Wireshark 1.12.x     before 1.12.9 and 2.0.x before 2.0.1 allows remote     attackers to cause a denial of service (application     crash) via a crafted packet with zlib compression.

  - CVE-2015-8722: epan/dissectors/packet-sctp.c in the SCTP     dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x     before 2.0.1 does not validate the frame pointer, which     allows remote attackers to cause a denial of service     (NULL pointer dereference and application crash) via a     crafted packet.

  - CVE-2015-8723: The AirPDcapPacketProcess function in     epan/crypt/airpdcap.c in the 802.11 dissector in     Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1     does not validate the relationship between the total     length and the capture length, which allows remote     attackers to cause a denial of service (stack-based     buffer overflow and application crash) via a crafted

  - CVE-2015-8724: The AirPDcapDecryptWPABroadcastKey     function in epan/crypt/airpdcap.c in the 802.11     dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x     before 2.0.1 does not verify the WPA broadcast key     length, which allows remote attackers to cause a denial     of service (out-of-bounds read and application crash)     via a crafted packet.

  - CVE-2015-8725: The     dissect_diameter_base_framed_ipv6_prefix function in     epan/dissectors/packet-diameter.c in the DIAMETER     dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x     before 2.0.1 does not validate the IPv6 prefix length,     which allows remote attackers to cause a denial of     service (stack-based buffer overflow and application     crash) via a crafted packet.

  - CVE-2015-8726: wiretap/vwr.c in the VeriWave file parser     in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1     does not validate certain signature and Modulation and     Coding Scheme (MCS) data, which allows remote attackers     to cause a denial of service (out-of-bounds read and     application crash) via a crafted file.

  - CVE-2015-8727: The dissect_rsvp_common function in     epan/dissectors/packet-rsvp.c in the RSVP dissector in     Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1     does not properly maintain request-key data, which     allows remote attackers to cause a denial of service     (use-after-free and application crash) via a crafted     packet.

  - CVE-2015-8728: The Mobile Identity parser in (1)     epan/dissectors/packet-ansi_a.c in the ANSI A dissector     and (2) epan/dissectors/packet-gsm_a_common.c in the GSM     A dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x     before 2.0.1 improperly uses the     tvb_bcd_dig_to_wmem_packet_str function, which allows     remote attackers to cause a denial of service (buffer     overflow and application crash) via a crafted packet.

  - CVE-2015-8729: The ascend_seek function in     wiretap/ascendtext.c in the Ascend file parser in     Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1     does not ensure the presence of a '\0' character at the     end of a date string, which allows remote attackers to     cause a denial of service (out-of-bounds read and     application crash) via a crafted file.

  - CVE-2015-8730: epan/dissectors/packet-nbap.c in the NBAP     dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x     before 2.0.1 does not validate the number of items,     which allows remote attackers to cause a denial of     service (invalid read operation and application crash)     via a crafted packet.

  - CVE-2015-8731: The dissct_rsl_ipaccess_msg function in     epan/dissectors/packet-rsl.c in the RSL dissector in     Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1     does not reject unknown TLV types, which allows remote     attackers to cause a denial of service (out-of-bounds     read and application crash) via a crafted packet.

  - CVE-2015-8732: The dissect_zcl_pwr_prof_pwrprofstatersp     function in epan/dissectors/packet-zbee-zcl-general.c in     the ZigBee ZCL dissector in Wireshark 1.12.x before     1.12.9 and 2.0.x before 2.0.1 does not validate the     Total Profile Number field, which allows remote     attackers to cause a denial of service (out-of-bounds     read and application crash) via a crafted packet.

  - CVE-2015-8733: The ngsniffer_process_record function in     wiretap/ngsniffer.c in the Sniffer file parser in     Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1     does not validate the relationships between record     lengths and record header lengths, which allows remote     attackers to cause a denial of service (out-of-bounds     read and application crash) via a crafted file.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

wireshark was updated to version 1.12.8 to fix ten security issues.

These security issues were fixed :

  - CVE-2015-6247: The dissect_openflow_tablemod_v5 function     in epan/dissectors/packet-openflow_v5.c in the OpenFlow     dissector in Wireshark 1.12.x before 1.12.7 did not     validate a certain offset value, which allowed remote     attackers to cause a denial of service (infinite loop)     via a crafted packet (bsc#941500).

  - CVE-2015-6246: The dissect_wa_payload function in     epan/dissectors/packet-waveagent.c in the WaveAgent     dissector in Wireshark 1.12.x before 1.12.7 mishandles     large tag values, which allowed remote attackers to     cause a denial of service (application crash) via a     crafted packet (bsc#941500).

  - CVE-2015-6245: epan/dissectors/packet-gsm_rlcmac.c in     the GSM RLC/MAC dissector in Wireshark 1.12.x before     1.12.7 used incorrect integer data types, which allowed     remote attackers to cause a denial of service (infinite     loop) via a crafted packet (bsc#941500).

  - CVE-2015-6244: The dissect_zbee_secure function in     epan/dissectors/packet-zbee-security.c in the ZigBee     dissector in Wireshark 1.12.x before 1.12.7 improperly     relies on length fields contained in packet data, which     allowed remote attackers to cause a denial of service     (application crash) via a crafted packet (bsc#941500).

  - CVE-2015-6243: The dissector-table implementation in     epan/packet.c in Wireshark 1.12.x before 1.12.7     mishandles table searches for empty strings, which     allowed remote attackers to cause a denial of service     (application crash) via a crafted packet, related to the     (1) dissector_get_string_handle and (2)     dissector_get_default_string_handle functions     (bsc#941500).

  - CVE-2015-6242: The wmem_block_split_free_chunk function     in epan/wmem/wmem_allocator_block.c in the wmem block     allocator in the memory manager in Wireshark 1.12.x     before 1.12.7 did not properly consider a certain case     of multiple realloc operations that restore a memory     chunk to its original size, which allowed remote     attackers to cause a denial of service (incorrect free     operation and application crash) via a crafted packet     (bsc#941500).

  - CVE-2015-6241: The proto_tree_add_bytes_item function in     epan/proto.c in the protocol-tree implementation in     Wireshark 1.12.x before 1.12.7 did not properly     terminate a data structure after a failure to locate a     number within a string, which allowed remote attackers     to cause a denial of service (application crash) via a     crafted packet (bsc#941500).

  - CVE-2015-7830: pcapng file parser could crash while     copying an interface filter (bsc#950437).

  - CVE-2015-6249: The dissect_wccp2r1_address_table_info     function in epan/dissectors/packet-wccp.c in the WCCP     dissector in Wireshark 1.12.x before 1.12.7 did not     prevent the conflicting use of a table for both IPv4 and     IPv6 addresses, which allowed remote attackers to cause     a denial of service (application crash) via a crafted     packet (bsc#941500).

  - CVE-2015-6248: The ptvcursor_add function in the     ptvcursor implementation in epan/proto.c in Wireshark     1.12.x before 1.12.7 did not check whether the expected     amount of data is available, which allowed remote     attackers to cause a denial of service (application     crash) via a crafted packet (bsc#941500).

Wireshark development team reports :

The following vulnerability has been fixed.

- wnpa-sec-2015-30

Pcapng file parser crash. (Bug 11455)

The version of Wireshark installed on the remote Windows host is 1.12.x prior to 1.12.8. It is, therefore, affected by a denial of service vulnerability due to a flaw in the pcapng file parser that is triggered when copying an interface filter. A remote attacker can exploit this, via a specially crafted copy routine packet, to crash the file parser.

Note that Nessus has not tested for this issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
89695	Debian DSA-3505-1 : wireshark - security update	Nessus	Debian Local Security Checks	medium
87912	SUSE SLED11 / SLES11 Security Update : wireshark (SUSE-SU-2016:0110-1)	Nessus	SuSE Local Security Checks	medium
87911	SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2016:0109-1)	Nessus	SuSE Local Security Checks	medium
86646	openSUSE Security Update : wireshark (openSUSE-2015-683)	Nessus	SuSE Local Security Checks	medium
86586	FreeBSD : wireshark -- Pcapng file parser crash (24e4d383-7b3e-11e5-a250-68b599b52a02)	Nessus	FreeBSD Local Security Checks	medium
86480	Wireshark 1.12.x < 1.12.8 pcapng File Parser DoS	Nessus	Windows	medium

Detections

Analytics

CVE-2015-7830

high

Tenable Plugins

medium

medium

medium

medium

medium

medium