Off-by-one error in epan/dissectors/packet-gsm_abis_oml.c in the GSM A-bis OML dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet that triggers a 0xff tag value.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Off-by-one error in epan/dissectors/packet-gsm_abis_oml.c in the GSM A-bis OML dissector in Wireshark     1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (buffer     over-read and application crash) via a crafted packet that triggers a 0xff tag value. (CVE-2016-4417)

Note that Nessus relies on the presence of the package as reported by the vendor.

Multiple vulnerabilities were discovered in the dissectors/parsers for DNP, RSL, LLRP, GSM A-bis OML, ASN 1 BER which could result in denial of service.

The version of Wireshark installed on the remote Windows host is prior to 2.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.0.2 advisory.

  - Untrusted search path vulnerability in the WiresharkApplication class in ui/qt/wireshark_application.cpp     in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 on Windows allows local users to gain privileges     via a Trojan horse riched20.dll.dll file in the current working directory, related to use of QLibrary.
    (CVE-2016-2521)

  - The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector     in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote     attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
    (CVE-2016-2522)

  - The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark     1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service     (infinite loop) via a crafted packet. (CVE-2016-2523)

  - epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the     algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted     packet. (CVE-2016-2524)

  - epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the     amount of header data, which allows remote attackers to cause a denial of service (memory consumption or     application crash) via a crafted packet. (CVE-2016-2525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 2.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.0.2 advisory.

  - Untrusted search path vulnerability in the WiresharkApplication class in ui/qt/wireshark_application.cpp     in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 on Windows allows local users to gain privileges     via a Trojan horse riched20.dll.dll file in the current working directory, related to use of QLibrary.
    (CVE-2016-2521)

  - The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector     in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote     attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
    (CVE-2016-2522)

  - The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark     1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service     (infinite loop) via a crafted packet. (CVE-2016-2523)

  - epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the     algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted     packet. (CVE-2016-2524)

  - epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the     amount of header data, which allows remote attackers to cause a denial of service (memory consumption or     application crash) via a crafted packet. (CVE-2016-2525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Wireshark development team reports :

The following vulnerabilities have been fixed :

- wnpa-sec-2016-02

ASN.1 BER dissector crash. (Bug 11828) CVE-2016-2522

- wnpa-sec-2016-03

DNP dissector infinite loop. (Bug 11938) CVE-2016-2523

- wnpa-sec-2016-04

X.509AF dissector crash. (Bug 12002) CVE-2016-2524

- wnpa-sec-2016-05

HTTP/2 dissector crash. (Bug 12077) CVE-2016-2525

- wnpa-sec-2016-06

HiQnet dissector crash. (Bug 11983) CVE-2016-2526

- wnpa-sec-2016-07

3GPP TS 32.423 Trace file parser crash. (Bug 11982)

CVE-2016-2527

- wnpa-sec-2016-08

LBMC dissector crash. (Bug 11984) CVE-2016-2528

- wnpa-sec-2016-09

iSeries file parser crash. (Bug 11985) CVE-2016-2529

- wnpa-sec-2016-10

RSL dissector crash. (Bug 11829) CVE-2016-2530 CVE-2016-2531

- wnpa-sec-2016-11

LLRP dissector crash. (Bug 12048) CVE-2016-2532

- wnpa-sec-2016-12

Ixia IxVeriWave file parser crash. (Bug 11795)

- wnpa-sec-2016-13

IEEE 802.11 dissector crash. (Bug 11818)

- wnpa-sec-2016-14

GSM A-bis OML dissector crash. (Bug 11825)

- wnpa-sec-2016-15

ASN.1 BER dissector crash. (Bug 12106)

- wnpa-sec-2016-16

SPICE dissector large loop. (Bug 12151)

- wnpa-sec-2016-17

NFS dissector crash.

- wnpa-sec-2016-18

ASN.1 BER dissector crash. (Bug 11822)

ID	Name	Product	Family	Type	Severity
219532	Linux Distros Unpatched Vulnerability : CVE-2016-4417	Nessus	Misc.	Local	medium
89878	Debian DSA-3516-1 : wireshark - security update	Nessus	Debian Local Security Checks	Local	medium
89104	Wireshark 2.0.x < 2.0.2 Multiple Vulnerabilities	Nessus	Windows	Local	high
89102	Wireshark 2.0.x < 2.0.2 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	Local	high
89048	FreeBSD : wireshark -- multiple vulnerabilities (45117749-df55-11e5-b2bd-002590263bf5)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2016-4417

medium

Tenable Plugins

medium

medium

high

high

medium