wiretap/toshiba.c in the Toshiba file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c (CVE-2018-6836)

  - Stack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x     through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of service (infinite     loop) via vectors involving self-referential ASN.1 CHOICE values. (CVE-2011-1142)

  - Multiple integer overflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers     to cause a denial of service (infinite loop) via vectors related to the (1) BACapp and (2) Bluetooth HCI     dissectors, a different vulnerability than CVE-2012-2392. (CVE-2012-3825)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c (CVE-2018-6836)

  - Stack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x     through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of service (infinite     loop) via vectors involving self-referential ASN.1 CHOICE values. (CVE-2011-1142)

  - The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table     searches for empty strings, which allows remote attackers to cause a denial of service (application crash)     via a crafted packet, related to the (1) dissector_get_string_handle and (2)     dissector_get_default_string_handle functions. (CVE-2015-6243)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c (CVE-2018-6836)

  - The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x     before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a     denial of service (application crash) via a crafted packet. (CVE-2014-2907)

  - The dissect_frame function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark     1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to     represent an error condition, which allows remote attackers to cause a denial of service (application     crash) via a crafted packet. (CVE-2014-4020)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

wireshark was updated to version 1.12.13 to fix the following issues :

  - CVE-2016-6504: wireshark: NDS dissector crash     (bnc#991012)

  - CVE-2016-6505: wireshark: PacketBB dissector could     divide by zero (bnc#991013)

  - CVE-2016-6506: wireshark: WSP infinite loop (bnc#991015)

  - CVE-2016-6507: wireshark: MMSE infinite loop     (bnc#991016)

  - CVE-2016-6508: wireshark: RLC long loop (bnc#991017)

  - CVE-2016-6509: wireshark: LDSS dissector crash     (bnc#991018)

  - CVE-2016-6510: wireshark: RLC dissector crash     (bnc#991019)

  - CVE-2016-6511: wireshark: OpenFlow long loop (bnc991020)

  - CVE-2016-5350: SPOOLS infinite loop (bsc#983671).

  - CVE-2016-5351: IEEE 802.11 dissector crash (bsc#983671).

  - CVE-2016-5352: IEEE 802.11 dissector crash, different     from wpna-sec-2016-30 (bsc#983671).

  - CVE-2016-5353: UMTS FP crash (bsc#983671).

  - CVE-2016-5354: USB dissector crash (bsc#983671).

  - CVE-2016-5355: Toshiba file parser crash (bsc#983671).

  - CVE-2016-5356: CoSine file parser crash (bsc#983671).

  - CVE-2016-5357: NetScreen file parser crash (bsc#983671).

  - CVE-2016-5358: Ethernet dissector crash (bsc#983671).

  - CVE-2016-5359: WBXML infinite loop (bsc#983671). For     more details please see:
    https://www.wireshark.org/docs/relnotes/wireshark-1.12.1     2.html     https://www.wireshark.org/docs/relnotes/wireshark-1.12.1     3.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to wireshark 1.12.13 fixes the following issues :

  - CVE-2016-6504: wireshark: NDS dissector crash     (bsc#991012)

  - CVE-2016-6505: wireshark: PacketBB dissector could     divide by zero (bsc#991013)

  - CVE-2016-6506: wireshark: WSP infinite loop (bsc#991015)

  - CVE-2016-6507: wireshark: MMSE infinite loop     (bsc#991016)

  - CVE-2016-6508: wireshark: RLC long loop (bsc#991017)

  - CVE-2016-6509: wireshark: LDSS dissector crash     (bsc#991018)

  - CVE-2016-6510: wireshark: RLC dissector crash     (bsc#991019)

  - CVE-2016-6511: wireshark: OpenFlow long loop (bnc991020)

  - CVE-2016-5350: SPOOLS infinite loop (bsc#983671)

  - CVE-2016-5351: IEEE 802.11 dissector crash (bsc#983671)

  - CVE-2016-5352: IEEE 802.11 dissector crash, different     from wpna-sec-2016-30 (bsc#983671)

  - CVE-2016-5353: UMTS FP crash (bsc#983671)

  - CVE-2016-5354: USB dissector crash (bsc#983671)

  - CVE-2016-5355: Toshiba file parser crash (bsc#983671)

  - CVE-2016-5356: CoSine file parser crash (bsc#983671)

  - CVE-2016-5357: NetScreen file parser crash (bsc#983671)

  - CVE-2016-5358: Ethernet dissector crash (bsc#983671)

  - CVE-2016-5359: WBXML infinite loop (bsc#983671) For more     details please see:
    https://www.wireshark.org/docs/relnotes/wireshark-1.12.1     2.html     https://www.wireshark.org/docs/relnotes/wireshark-1.12.1     3.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Wireshark development team reports :

The following vulnerabilities have been fixed :

- wnpa-sec-2016-29

The SPOOLS dissector could go into an infinite loop. Discovered by the CESG.

- wnpa-sec-2016-30

The IEEE 802.11 dissector could crash. (Bug 11585)

- wnpa-sec-2016-31

The IEEE 802.11 dissector could crash. Discovered by Mateusz Jurczyk.
(Bug 12175)

- wnpa-sec-2016-32

The UMTS FP dissector could crash. (Bug 12191)

- wnpa-sec-2016-33

Some USB dissectors could crash. Discovered by Mateusz Jurczyk. (Bug 12356)

- wnpa-sec-2016-34

The Toshiba file parser could crash. Discovered by iDefense Labs. (Bug 12394)

- wnpa-sec-2016-35

The CoSine file parser could crash. Discovered by iDefense Labs. (Bug 12395)

- wnpa-sec-2016-36

The NetScreen file parser could crash. Discovered by iDefense Labs.
(Bug 12396)

- wnpa-sec-2016-37

The Ethernet dissector could crash. (Bug 12440)

Multiple vulnerabilities were discovered in the dissectors/parsers for PKTC, IAX2, GSM CBCH and NCP, SPOOLS, IEEE 802.11, UMTS FP, USB, Toshiba, CoSine, NetScreen, WBXML which could result in denial of service or potentially the execution of arbitrary code.

The following vulnerabilities have been discovered in the Wheezy's Wireshark version :

CVE-2016-5350

The SPOOLS dissector could go into an infinite loop

CVE-2016-5351

The IEEE 802.11 dissector could crash

CVE-2016-5353

The UMTS FP dissector could crash

CVE-2016-5354

Some USB dissectors could crash

CVE-2016-5355

The Toshiba file parser could crash

CVE-2016-5356

The CoSine file parser could crash

CVE-2016-5357

The NetScreen file parser could crash

CVE-2016-5359

The WBXML dissector could go into an infinite loop

For Debian 7 'Wheezy', these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u6~deb7u2.

We recommend that you upgrade your wireshark packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.4. It is, therefore, affected by multiple denial of service vulnerabilities :

  - An infinite loop exists in the SPOOLs dissector. A     remote attacker, via a specially crafted packet or trace     file, can exploit this to exhaust CPU resources,     resulting in a denial of service condition.
    (CVE-2016-5350)

  - A flaw exists in the IEEE 802.11 dissector that is     triggered when handling a malformed packet or trace     file. A remote attacker can exploit this to cause a     denial of service condition. (CVE-2016-5351)

  - An out-of-bounds read error exists in the     AirPDcapDecryptWPABroadcastKey() function in airpdcap.c     that allows a remote attacker to disclose memory     contents or cause a denial of service condition.
    (CVE-2016-5352)

  - A flaw exists in the UMTS FP dissector that is triggered     when handling a malformed packet or trace file. A remote     attacker can exploit this to cause a denial of service     condition. (CVE-2016-5353)

  - A flaw exists in multiple USB dissectors that is     triggered when a handling malformed packet or trace     file. A remote attacker can exploit this to cause a     denial of service condition. (CVE-2016-5354)

  - A flaw exists in the Toshiba file parser that is     triggered when handling a malformed packet trace file. A     remote attacker can exploit this, by convincing a user     to open a specially crafted packet trace file, to cause     a denial of service condition. (CVE-2016-5355)

  - A flaw exists in the CoSine file parser that is     triggered when handling a malformed packet trace file. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2016-5356)

  - A flaw exists in the NetScreen file parser that is     triggered when handling a malformed packet trace file. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2016-5357)

  - A flaw exists in the Ethernet dissector that is     triggered when handling a malformed packet or trace     file. A remote attacker can exploit this to cause a     denial of service condition. (CVE-2016-5358)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote Windows host is 1.12.x prior to 1.12.12. It is, therefore, affected by multiple denial of service vulnerabilities :

  - An infinite loop exists in the SPOOLs dissector. A     remote attacker, via a specially crafted packet or trace     file, can exploit this to exhaust CPU resources,     resulting in a denial of service condition.
    (CVE-2016-5350)

  - A flaw exists in the IEEE 802.11 dissector that is     triggered when handling a malformed packet or trace     file. A remote attacker can exploit this to cause a     denial of service condition. (CVE-2016-5351)

  - A flaw exists in the UMTS FP dissector that is triggered     when handling a malformed packet or trace file. A remote     attacker can exploit this to cause a denial of service     condition. (CVE-2016-5353)

  - A flaw exists in multiple USB dissectors that is     triggered when a handling malformed packet or trace     file. A remote attacker can exploit this to cause a     denial of service condition. (CVE-2016-5354)

  - A flaw exists in the Toshiba file parser that is     triggered when handling a malformed packet trace file. A     remote attacker can exploit this, by convincing a user     to open a specially crafted packet trace file, to cause     a denial of service condition. (CVE-2016-5355)

  - A flaw exists in the CoSine file parser that is     triggered when handling a malformed packet trace file. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2016-5356)

  - A flaw exists in the NetScreen file parser that is     triggered when handling a malformed packet trace file. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2016-5357)

  - An integer overflow condition exists in the WBXML     dissector. A remote attacker can exploit this, via a     specially crafted packet or trace file, to exhaust CPU     resources, resulting in a denial of service condition.
    (CVE-2016-5359)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for wireshark fixes an number of security issues.

Issues in protocol dissectors could have allowed a remote attacker to crash Wireshark or cause excessive CPU usage through specially crafted packages inserted into the network or a capture file.

  - CVE-2016-5350: The SPOOLS dissector could go into an     infinite loop

  - CVE-2016-5351: The IEEE 802.11 dissector could crash

  - CVE-2016-5353: The UMTS FP dissector could crash

  - CVE-2016-5354: Some USB dissectors could crash

  - CVE-2016-5355: The Toshiba file parser could crash

  - CVE-2016-5356: The CoSine file parser could crash

  - CVE-2016-5357: The NetScreen file parser could crash

  - CVE-2016-5358: The Ethernet dissector could crash

ID	Name	Product	Family	Severity
199535	RHEL 5 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199531	RHEL 6 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199503	RHEL 7 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
93863	SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2016:2453-1)	Nessus	SuSE Local Security Checks	high
93342	SUSE SLES11 Security Update : wireshark (SUSE-SU-2016:2212-1)	Nessus	SuSE Local Security Checks	high
91928	FreeBSD : wireshark -- multiple vulnerabilities (313e9557-41e8-11e6-ab34-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
91926	Debian DSA-3615-1 : wireshark - security update	Nessus	Debian Local Security Checks	high
91905	Debian DLA-538-1 : wireshark security update	Nessus	Debian Local Security Checks	high
91821	Wireshark 2.0.x < 2.0.4 Multiple DoS	Nessus	Windows	medium
91820	Wireshark 1.12.x < 1.12.12 Multiple DoS	Nessus	Windows	medium
91705	openSUSE Security Update : wireshark (openSUSE-2016-737)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-5355

medium

Tenable Plugins

critical

critical

critical

high

high

high

high

high

medium

medium

high