The get_value function in epan/dissectors/packet-btatt.c in the Bluetooth Attribute (aka BT ATT) dissector in Wireshark 2.0.x before 2.0.1 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (invalid write operation and application crash) via a crafted packet.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 2.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.0.1 advisory.

  - The dissect_CPMSetBindings function in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark     2.0.x before 2.0.1 does not validate the column size, which allows remote attackers to cause a denial of     service (memory consumption or application crash) via a crafted packet. (CVE-2015-8742)

  - epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before     2.0.1 does not validate conversation data, which allows remote attackers to cause a denial of service     (NULL pointer dereference and application crash) via a crafted packet. (CVE-2015-8711)

  - Double free vulnerability in epan/dissectors/packet-nlm.c in the NLM dissector in Wireshark 1.12.x before     1.12.9 and 2.0.x before 2.0.1, when the Match MSG/RES packets for async NLM option is enabled, allows     remote attackers to cause a denial of service (application crash) via a crafted packet. (CVE-2015-8718)

  - The dissect_ber_GeneralizedTime function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark     1.12.x before 1.12.9 and 2.0.x before 2.0.1 improperly checks an sscanf return value, which allows remote     attackers to cause a denial of service (application crash) via a crafted packet. (CVE-2015-8720)

  - Buffer overflow in the tvb_uncompress function in epan/tvbuff_zlib.c in Wireshark 1.12.x before 1.12.9 and     2.0.x before 2.0.1 allows remote attackers to cause a denial of service (application crash) via a crafted     packet with zlib compression. (CVE-2015-8721)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201604-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause Denial of Service and local attackers could       escalate privileges.
  Workaround :

    There is no known workaround at this time.

The version of Wireshark installed on the remote Windows host is prior to 2.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.0.1 advisory.

  - The dissect_CPMSetBindings function in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark     2.0.x before 2.0.1 does not validate the column size, which allows remote attackers to cause a denial of     service (memory consumption or application crash) via a crafted packet. (CVE-2015-8742)

  - epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before     2.0.1 does not validate conversation data, which allows remote attackers to cause a denial of service     (NULL pointer dereference and application crash) via a crafted packet. (CVE-2015-8711)

  - Double free vulnerability in epan/dissectors/packet-nlm.c in the NLM dissector in Wireshark 1.12.x before     1.12.9 and 2.0.x before 2.0.1, when the Match MSG/RES packets for async NLM option is enabled, allows     remote attackers to cause a denial of service (application crash) via a crafted packet. (CVE-2015-8718)

  - The dissect_ber_GeneralizedTime function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark     1.12.x before 1.12.9 and 2.0.x before 2.0.1 improperly checks an sscanf return value, which allows remote     attackers to cause a denial of service (application crash) via a crafted packet. (CVE-2015-8720)

  - Buffer overflow in the tvb_uncompress function in epan/tvbuff_zlib.c in Wireshark 1.12.x before 1.12.9 and     2.0.x before 2.0.1 allows remote attackers to cause a denial of service (application crash) via a crafted     packet with zlib compression. (CVE-2015-8721)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
368085	Wireshark 2.0.x < 2.0.1 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	Local	medium
90744	GLSA-201604-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
87825	Wireshark 2.0.x < 2.0.1 Multiple Vulnerabilities	Nessus	Windows	Local	medium

Detections

Analytics

CVE-2015-8735

medium

Tenable Plugins

medium

high

medium