In Wireshark 2.2.0 to 2.2.1, the Profinet I/O dissector could loop excessively, triggered by network traffic or a capture file. This was addressed in plugins/profinet/packet-pn-rtc-one.c by rejecting input with too many I/O objects.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 2.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.2.2 advisory.

  - In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the OpenFlow dissector could crash with memory exhaustion,     triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-openflow_v5.c     by ensuring that certain length values were sufficiently large. (CVE-2016-9376)

  - In Wireshark 2.2.0 to 2.2.1, the Profinet I/O dissector could loop excessively, triggered by network     traffic or a capture file. This was addressed in plugins/profinet/packet-pn-rtc-one.c by rejecting input     with too many I/O objects. (CVE-2016-9372)

  - In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the AllJoyn dissector could crash with a buffer over-read,     triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-alljoyn.c by     ensuring that a length variable properly tracked the state of a signature variable. (CVE-2016-9374)

  - In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DCERPC dissector could crash with a use-after-free,     triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dcerpc-nt.c     and epan/dissectors/packet-dcerpc-spoolss.c by using the wmem file scope for private strings.
    (CVE-2016-9373)

  - In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DTN dissector could go into an infinite loop,     triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dtn.c by     checking whether SDNV evaluation was successful. (CVE-2016-9375)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Wireshark 2.2.0 to 2.2.1, the Profinet I/O dissector could loop excessively, triggered by network     traffic or a capture file. This was addressed in plugins/profinet/packet-pn-rtc-one.c by rejecting input     with too many I/O objects. (CVE-2016-9372)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In Wireshark 2.2.0, the NCP dissector could crash, triggered by packet injection or a malformed capture
    file. This was addressed in epan/dissectors/CMakeLists.txt by registering this dissector. (CVE-2016-7958)

  - In Wireshark 2.2.0, the Bluetooth L2CAP dissector could crash, triggered by packet injection or a
    malformed capture file. This was addressed in epan/dissectors/packet-btl2cap.c by avoiding use of a seven-
    byte memcmp for potentially shorter strings. (CVE-2016-7957)

  - In Wireshark 2.2.0 to 2.2.1, the Profinet I/O dissector could loop excessively, triggered by network
    traffic or a capture file. This was addressed in plugins/profinet/packet-pn-rtc-one.c by rejecting input
    with too many I/O objects. (CVE-2016-9372)

  - In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DCERPC dissector could crash with a use-after-free,
    triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dcerpc-nt.c
    and epan/dissectors/packet-dcerpc-spoolss.c by using the wmem file scope for private strings.
    (CVE-2016-9373)

Wireshark project reports :

Wireshark project is releasing Wireshark 2.2.2, which addresses :

- wnpa-sec-2016-58: Profinet I/O long loop - CVE-2016-9372

- wnpa-sec-2016-59: AllJoyn crash - CVE-2016-9374

- wnpa-sec-2016-60: OpenFlow crash - CVE-2016-9376

- wnpa-sec-2016-61: DCERPC crash - CVE-2016-9373

- wnpa-sec-2016-62: DTN infinite loop - CVE-2016-9375

The version of Wireshark installed on the remote Windows host is prior to 2.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.2.2 advisory.

  - In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the OpenFlow dissector could crash with memory exhaustion,     triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-openflow_v5.c     by ensuring that certain length values were sufficiently large. (CVE-2016-9376)

  - In Wireshark 2.2.0 to 2.2.1, the Profinet I/O dissector could loop excessively, triggered by network     traffic or a capture file. This was addressed in plugins/profinet/packet-pn-rtc-one.c by rejecting input     with too many I/O objects. (CVE-2016-9372)

  - In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the AllJoyn dissector could crash with a buffer over-read,     triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-alljoyn.c by     ensuring that a length variable properly tracked the state of a signature variable. (CVE-2016-9374)

  - In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DCERPC dissector could crash with a use-after-free,     triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dcerpc-nt.c     and epan/dissectors/packet-dcerpc-spoolss.c by using the wmem file scope for private strings.
    (CVE-2016-9373)

  - In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DTN dissector could go into an infinite loop,     triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dtn.c by     checking whether SDNV evaluation was successful. (CVE-2016-9375)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update to wireshark 2.2.2 fixes the following issues :

  - CVE-2016-9372: Profinet I/O long loop (boo#1010807)

  - CVE-2016-9374: AllJoyn crash (boo#1010752)

  - CVE-2016-9376: OpenFlow crash (boo#1010735)

  - CVE-2016-9373: DCERPC crash (boo#1010754)

  - CVE-2016-9375: DTN infinite loop (boo#1010740)

This update also contains urther bug fixes and updated protocol support as listed in:
https://www.wireshark.org/docs/relnotes/wireshark-2.2.2.html

ID	Name	Product	Family	Type	Severity
311463	Wireshark 2.2.x < 2.2.2 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	Local	medium
220053	Linux Distros Unpatched Vulnerability : CVE-2016-9372	Nessus	Misc.	Local	medium
400919	Alpine: tshark, multiple wireshark packages: security update to 2.2.0-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
400919	Alpine: tshark, multiple wireshark packages: security update to 2.2.0-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
95451	FreeBSD : wireshark -- multiple vulnerabilities (7fff2b16-b0ee-11e6-86b8-589cfc054129)	Nessus	FreeBSD Local Security Checks	Local	medium
95435	Wireshark 2.2.x < 2.2.2 Multiple Vulnerabilities	Nessus	Windows	Local	medium
95395	openSUSE Security Update : wireshark (openSUSE-2016-2923)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2016-9372

medium

Tenable Plugins

medium

medium

high

high

medium

medium

medium