The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet that triggers the attempted processing of an empty line.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip     '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and     application crash) via a crafted packet that triggers the attempted processing of an empty line.
    (CVE-2017-17935)

Note that Nessus relies on the presence of the package as reported by the vendor.

Several issues in wireshark, a tool that captures and analyzes packets off the wire, have been found by different people. These are basically issues with length checks or invalid memory access in different dissectors. This could result in infinite loops or crashes by malicious packets.

For Debian 8 'Jessie', these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u16.

We recommend that you upgrade your wireshark packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-17935, rebase to 2.4.4

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for wireshark to version 2.2.12 fixes the following issues :

  - CVE-2018-5334: IxVeriWave file could crash (bsc#1075737)

  - CVE-2018-5335: WCP dissector could crash (bsc#1075738)

  - CVE-2018-5336: Multiple dissector crashes (bsc#1075739)

  - CVE-2017-17935: Incorrect handling of '\n' in     file_read_line function could have lead to denial of     service (bsc#1074171) This release no longer enables the     Linux kernel BPF JIT compiler via the     net.core.bpf_jit_enable sysctl, as this would make     systems more vulnerable to Spectre variant 1     CVE-2017-5753 - (bsc#1075748) Further bug fixes and     updated protocol support as listed in:
    https://www.wireshark.org/docs/relnotes/wireshark-2.2.12     .html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
221115	Linux Distros Unpatched Vulnerability : CVE-2017-17935	Nessus	Misc.	Local	high
121193	Debian DLA-1634-1 : wireshark security update	Nessus	Debian Local Security Checks	Local	high
106519	Fedora 27 : 1:wireshark (2018-8c3a01cc65)	Nessus	Fedora Local Security Checks	Local	high
106342	SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2018:0191-1) (Spectre)	Nessus	SuSE Local Security Checks	Local	medium
106293	SUSE SLES11 Security Update : wireshark (SUSE-SU-2018:0179-1) (Spectre)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2017-17935

high

Tenable Plugins

high

high

high

medium

medium