epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length values, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 2.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.0.4 advisory.

  - epan/dissectors/packet-pktap.c in the Ethernet dissector in Wireshark 2.x before 2.0.4 mishandles the     packet-header data type, which allows remote attackers to cause a denial of service (application crash)     via a crafted packet. (CVE-2016-5358)

  - epan/dissectors/packet-dcerpc-spoolss.c in the SPOOLS component in Wireshark 1.12.x before 1.12.12 and 2.x     before 2.0.4 mishandles unexpected offsets, which allows remote attackers to cause a denial of service     (infinite loop) via a crafted packet. (CVE-2016-5350)

  - epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4     mishandles the lack of an EAPOL_RSN_KEY, which allows remote attackers to cause a denial of service     (application crash) via a crafted packet. (CVE-2016-5351)

  - epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length     values, which allows remote attackers to cause a denial of service (application crash) via a crafted     packet. (CVE-2016-5352)

  - epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.12 and 2.x     before 2.0.4 mishandles the reserved C/T value, which allows remote attackers to cause a denial of service     (application crash) via a crafted packet. (CVE-2016-5353)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length     values, which allows remote attackers to cause a denial of service (application crash) via a crafted     packet. (CVE-2016-5352)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - epan/dissectors/packet-pktap.c in the Ethernet dissector in Wireshark 2.x before 2.0.4 mishandles the
    packet-header data type, which allows remote attackers to cause a denial of service (application crash)
    via a crafted packet. (CVE-2016-5358)

  - epan/dissectors/packet-dcerpc-spoolss.c in the SPOOLS component in Wireshark 1.12.x before 1.12.12 and 2.x
    before 2.0.4 mishandles unexpected offsets, which allows remote attackers to cause a denial of service
    (infinite loop) via a crafted packet. (CVE-2016-5350)

  - epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4
    mishandles the lack of an EAPOL_RSN_KEY, which allows remote attackers to cause a denial of service
    (application crash) via a crafted packet. (CVE-2016-5351)

  - epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length
    values, which allows remote attackers to cause a denial of service (application crash) via a crafted
    packet. (CVE-2016-5352)

  - epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.12 and 2.x
    before 2.0.4 mishandles the reserved C/T value, which allows remote attackers to cause a denial of service
    (application crash) via a crafted packet. (CVE-2016-5353)

wireshark was updated to version 1.12.13 to fix the following issues :

  - CVE-2016-6504: wireshark: NDS dissector crash     (bnc#991012)

  - CVE-2016-6505: wireshark: PacketBB dissector could     divide by zero (bnc#991013)

  - CVE-2016-6506: wireshark: WSP infinite loop (bnc#991015)

  - CVE-2016-6507: wireshark: MMSE infinite loop     (bnc#991016)

  - CVE-2016-6508: wireshark: RLC long loop (bnc#991017)

  - CVE-2016-6509: wireshark: LDSS dissector crash     (bnc#991018)

  - CVE-2016-6510: wireshark: RLC dissector crash     (bnc#991019)

  - CVE-2016-6511: wireshark: OpenFlow long loop (bnc991020)

  - CVE-2016-5350: SPOOLS infinite loop (bsc#983671).

  - CVE-2016-5351: IEEE 802.11 dissector crash (bsc#983671).

  - CVE-2016-5352: IEEE 802.11 dissector crash, different     from wpna-sec-2016-30 (bsc#983671).

  - CVE-2016-5353: UMTS FP crash (bsc#983671).

  - CVE-2016-5354: USB dissector crash (bsc#983671).

  - CVE-2016-5355: Toshiba file parser crash (bsc#983671).

  - CVE-2016-5356: CoSine file parser crash (bsc#983671).

  - CVE-2016-5357: NetScreen file parser crash (bsc#983671).

  - CVE-2016-5358: Ethernet dissector crash (bsc#983671).

  - CVE-2016-5359: WBXML infinite loop (bsc#983671). For     more details please see:
    https://www.wireshark.org/docs/relnotes/wireshark-1.12.1     2.html     https://www.wireshark.org/docs/relnotes/wireshark-1.12.1     3.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to wireshark 1.12.13 fixes the following issues :

  - CVE-2016-6504: wireshark: NDS dissector crash     (bsc#991012)

  - CVE-2016-6505: wireshark: PacketBB dissector could     divide by zero (bsc#991013)

  - CVE-2016-6506: wireshark: WSP infinite loop (bsc#991015)

  - CVE-2016-6507: wireshark: MMSE infinite loop     (bsc#991016)

  - CVE-2016-6508: wireshark: RLC long loop (bsc#991017)

  - CVE-2016-6509: wireshark: LDSS dissector crash     (bsc#991018)

  - CVE-2016-6510: wireshark: RLC dissector crash     (bsc#991019)

  - CVE-2016-6511: wireshark: OpenFlow long loop (bnc991020)

  - CVE-2016-5350: SPOOLS infinite loop (bsc#983671)

  - CVE-2016-5351: IEEE 802.11 dissector crash (bsc#983671)

  - CVE-2016-5352: IEEE 802.11 dissector crash, different     from wpna-sec-2016-30 (bsc#983671)

  - CVE-2016-5353: UMTS FP crash (bsc#983671)

  - CVE-2016-5354: USB dissector crash (bsc#983671)

  - CVE-2016-5355: Toshiba file parser crash (bsc#983671)

  - CVE-2016-5356: CoSine file parser crash (bsc#983671)

  - CVE-2016-5357: NetScreen file parser crash (bsc#983671)

  - CVE-2016-5358: Ethernet dissector crash (bsc#983671)

  - CVE-2016-5359: WBXML infinite loop (bsc#983671) For more     details please see:
    https://www.wireshark.org/docs/relnotes/wireshark-1.12.1     2.html     https://www.wireshark.org/docs/relnotes/wireshark-1.12.1     3.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Wireshark development team reports :

The following vulnerabilities have been fixed :

- wnpa-sec-2016-29

The SPOOLS dissector could go into an infinite loop. Discovered by the CESG.

- wnpa-sec-2016-30

The IEEE 802.11 dissector could crash. (Bug 11585)

- wnpa-sec-2016-31

The IEEE 802.11 dissector could crash. Discovered by Mateusz Jurczyk.
(Bug 12175)

- wnpa-sec-2016-32

The UMTS FP dissector could crash. (Bug 12191)

- wnpa-sec-2016-33

Some USB dissectors could crash. Discovered by Mateusz Jurczyk. (Bug 12356)

- wnpa-sec-2016-34

The Toshiba file parser could crash. Discovered by iDefense Labs. (Bug 12394)

- wnpa-sec-2016-35

The CoSine file parser could crash. Discovered by iDefense Labs. (Bug 12395)

- wnpa-sec-2016-36

The NetScreen file parser could crash. Discovered by iDefense Labs.
(Bug 12396)

- wnpa-sec-2016-37

The Ethernet dissector could crash. (Bug 12440)

The version of Wireshark installed on the remote Windows host is prior to 2.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.0.4 advisory.

  - epan/dissectors/packet-pktap.c in the Ethernet dissector in Wireshark 2.x before 2.0.4 mishandles the     packet-header data type, which allows remote attackers to cause a denial of service (application crash)     via a crafted packet. (CVE-2016-5358)

  - epan/dissectors/packet-dcerpc-spoolss.c in the SPOOLS component in Wireshark 1.12.x before 1.12.12 and 2.x     before 2.0.4 mishandles unexpected offsets, which allows remote attackers to cause a denial of service     (infinite loop) via a crafted packet. (CVE-2016-5350)

  - epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4     mishandles the lack of an EAPOL_RSN_KEY, which allows remote attackers to cause a denial of service     (application crash) via a crafted packet. (CVE-2016-5351)

  - epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length     values, which allows remote attackers to cause a denial of service (application crash) via a crafted     packet. (CVE-2016-5352)

  - epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.12 and 2.x     before 2.0.4 mishandles the reserved C/T value, which allows remote attackers to cause a denial of service     (application crash) via a crafted packet. (CVE-2016-5353)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
311441	Wireshark 2.0.x < 2.0.4 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high
219665	Linux Distros Unpatched Vulnerability : CVE-2016-5352	Nessus	Misc.	medium
400971	Alpine: tshark, multiple wireshark packages: security update to 2.0.3-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400971	Alpine: tshark, multiple wireshark packages: security update to 2.0.3-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
93863	SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2016:2453-1)	Nessus	SuSE Local Security Checks	high
93342	SUSE SLES11 Security Update : wireshark (SUSE-SU-2016:2212-1)	Nessus	SuSE Local Security Checks	high
91928	FreeBSD : wireshark -- multiple vulnerabilities (313e9557-41e8-11e6-ab34-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
91821	Wireshark 2.0.x < 2.0.4 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2016-5352

medium

Tenable Plugins

high

medium

high

high

high

high

high

high