97636

1038262

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13466

https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=671e32820ab29d41d712cc8a472eab9b672684d9

[debian-lts-announce] 20190115 [SECURITY] [DLA 1634-1] wireshark security update

GLSA-201706-12

https://www.wireshark.org/security/wnpa-sec-2017-12.html

Several issues in wireshark, a tool that captures and analyzes packets off the wire, have been found by different people. These are basically issues with length checks or invalid memory access in different dissectors. This could result in infinite loops or crashes by malicious packets.

For Debian 8 'Jessie', these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u16.

We recommend that you upgrade your wireshark packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201706-12 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       network packet using Wireshark, possibly resulting a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

Wireshark was updated to version 2.2.6, which brings several new features, enhancements and bug fixes. Thses security issues were fixed :

  - CVE-2017-7700: In Wireshark the NetScaler file parser     could go into an infinite loop, triggered by a malformed     capture file. This was addressed in wiretap/netscaler.c     by ensuring a nonzero record size (bsc#1033936)

  - CVE-2017-7701: In Wireshark the BGP dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-bgp.c by using a different     integer data type (bsc#1033937)

  - CVE-2017-7702: In Wireshark the WBXML dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-wbxml.c by adding length     validation (bsc#1033938)

  - CVE-2017-7703: In Wireshark the IMAP dissector could     crash, triggered by packet injection or a malformed     capture file. This was addressed in     epan/dissectors/packet-imap.c by calculating a line's     end correctly (bsc#1033939)

  - CVE-2017-7704: In Wireshark the DOF dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-dof.c by using a different     integer data type and adjusting a return value     (bsc#1033940)

  - CVE-2017-7705: In Wireshark the RPC over RDMA dissector     could go into an infinite loop, triggered by packet     injection or a malformed capture file. This was     addressed in epan/dissectors/packet-rpcrdma.c by     correctly checking for going beyond the maximum offset     (bsc#1033941)

  - CVE-2017-7745: In Wireshark the SIGCOMP dissector could     go into an infinite loop, triggered by packet injection     or a malformed capture file. This was addressed in     epan/dissectors/packet-sigcomp.c by correcting a     memory-size check (bsc#1033942)

  - CVE-2017-7746: In Wireshark the SLSK dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-slsk.c by adding checks for the     remaining length (bsc#1033943)

  - CVE-2017-7747: In Wireshark the PacketBB dissector could     crash, triggered by packet injection or a malformed     capture file. This was addressed in     epan/dissectors/packet-packetbb.c by restricting     additions to the protocol tree (bsc#1033944)

  - CVE-2017-7748: In Wireshark the WSP dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-wsp.c by adding a length check     (bsc#1033945)

  - CVE-2017-6014: In Wireshark a crafted or malformed     STANAG 4607 capture file will cause an infinite loop and     memory exhaustion. If the packet size field in a packet     header is null, the offset to read from will not     advance, causing continuous attempts to read the same     zero length packet. This will quickly exhaust all system     memory (bsc#1025913)

  - CVE-2017-5596: In Wireshark the ASTERIX dissector could     go into an infinite loop, triggered by packet injection     or a malformed capture file. This was addressed in     epan/dissectors/packet-asterix.c by changing a data type     to avoid an integer overflow (bsc#1021739)

  - CVE-2017-5597: In Wireshark the DHCPv6 dissector could     go into a large loop, triggered by packet injection or a     malformed capture file. This was addressed in     epan/dissectors/packet-dhcpv6.c by changing a data type     to avoid an integer overflow (bsc#1021739)

  - CVE-2016-9376: In Wireshark the OpenFlow dissector could     crash with memory exhaustion, triggered by network     traffic or a capture file. This was addressed in     epan/dissectors/packet-openflow_v5.c by ensuring that     certain length values were sufficiently large     (bsc#1010735)

  - CVE-2016-9375: In Wireshark the DTN dissector could go     into an infinite loop, triggered by network traffic or a     capture file. This was addressed in     epan/dissectors/packet-dtn.c by checking whether SDNV     evaluation was successful (bsc#1010740)

  - CVE-2016-9374: In Wireshark the AllJoyn dissector could     crash with a buffer over-read, triggered by network     traffic or a capture file. This was addressed in     epan/dissectors/packet-alljoyn.c by ensuring that a     length variable properly tracked the state of a     signature variable (bsc#1010752)

  - CVE-2016-9373: In Wireshark the DCERPC dissector could     crash with a use-after-free, triggered by network     traffic or a capture file. This was addressed in     epan/dissectors/packet-dcerpc-nt.c and     epan/dissectors/packet-dcerpc-spoolss.c by using the     wmem file scope for private strings (bsc#1010754)

  - CVE-2016-7180: epan/dissectors/packet-ipmi-trace.c in     the IPMI trace dissector in Wireshark did not properly     consider whether a string is constant, which allowed     remote attackers to cause a denial of service     (use-after-free and application crash) via a crafted     packet (bsc#998800)

  - CVE-2016-7179: Stack-based buffer overflow in     epan/dissectors/packet-catapult-dct2000.c in the     Catapult DCT2000 dissector in Wireshark allowed remote     attackers to cause a denial of service (application     crash) via a crafted packet (bsc#998963)

  - CVE-2016-7178: epan/dissectors/packet-umts_fp.c in the     UMTS FP dissector in Wireshark did not ensure that     memory is allocated for certain data structures, which     allowed remote attackers to cause a denial of service     (invalid write access and application crash) via a     crafted packet (bsc#998964)

  - CVE-2016-7177: epan/dissectors/packet-catapult-dct2000.c     in the Catapult DCT2000 dissector in Wireshark did not     restrict the number of channels, which allowed remote     attackers to cause a denial of service (buffer over-read     and application crash) via a crafted packet (bsc#998763)

  - CVE-2016-7176: epan/dissectors/packet-h225.c in the     H.225 dissector in Wireshark called snprintf with one of     its input buffers as the output buffer, which allowed     remote attackers to cause a denial of service (copy     overlap and application crash) via a crafted packet     (bsc#998762)

  - CVE-2016-7175: epan/dissectors/packet-qnet6.c in the     QNX6 QNET dissector in Wireshark mishandled MAC address     data, which allowed remote attackers to cause a denial     of service (out-of-bounds read and application crash)     via a crafted packet (bsc#998761)

  - CVE-2016-6354: Heap-based buffer overflow in the     yy_get_next_buffer function in Flex might have allowed     context-dependent attackers to cause a denial of service     or possibly execute arbitrary code via vectors involving     num_to_read (bsc#990856).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Wireshark was updated to version 2.0.12, which brings several new features, enhancements and bug fixes. These security issues were fixed :

  - CVE-2017-7700: In Wireshark the NetScaler file parser     could go into an infinite loop, triggered by a malformed     capture file. This was addressed in wiretap/netscaler.c     by ensuring a nonzero record size (bsc#1033936).

  - CVE-2017-7701: In Wireshark the BGP dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-bgp.c by using a different     integer data type (bsc#1033937).

  - CVE-2017-7702: In Wireshark the WBXML dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-wbxml.c by adding length     validation (bsc#1033938).

  - CVE-2017-7703: In Wireshark the IMAP dissector could     crash, triggered by packet injection or a malformed     capture file. This was addressed in     epan/dissectors/packet-imap.c by calculating a line's     end correctly (bsc#1033939).

  - CVE-2017-7704: In Wireshark the DOF dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-dof.c by using a different     integer data type and adjusting a return value     (bsc#1033940).

  - CVE-2017-7705: In Wireshark the RPC over RDMA dissector     could go into an infinite loop, triggered by packet     injection or a malformed capture file. This was     addressed in epan/dissectors/packet-rpcrdma.c by     correctly checking for going beyond the maximum offset     (bsc#1033941).

  - CVE-2017-7745: In Wireshark the SIGCOMP dissector could     go into an infinite loop, triggered by packet injection     or a malformed capture file. This was addressed in     epan/dissectors/packet-sigcomp.c by correcting a     memory-size check (bsc#1033942).

  - CVE-2017-7746: In Wireshark the SLSK dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-slsk.c by adding checks for the     remaining length (bsc#1033943).

  - CVE-2017-7747: In Wireshark the PacketBB dissector could     crash, triggered by packet injection or a malformed     capture file. This was addressed in     epan/dissectors/packet-packetbb.c by restricting     additions to the protocol tree (bsc#1033944).

  - CVE-2017-7748: In Wireshark the WSP dissector could go     into an infinite loop, triggered by packet injection or     a malformed capture file. This was addressed in     epan/dissectors/packet-wsp.c by adding a length check     (bsc#1033945).

  - CVE-2016-7179: Stack-based buffer overflow in     epan/dissectors/packet-catapult-dct2000.c in the     Catapult DCT2000 dissector in Wireshark allowed remote     attackers to cause a denial of service (application     crash) via a crafted packet (bsc#998963).

  - CVE-2016-9376: In Wireshark the OpenFlow dissector could     crash with memory exhaustion, triggered by network     traffic or a capture file. This was addressed in     epan/dissectors/packet-openflow_v5.c by ensuring that     certain length values were sufficiently large     (bsc#1010735).

  - CVE-2016-9375: In Wireshark the DTN dissector could go     into an infinite loop, triggered by network traffic or a     capture file. This was addressed in     epan/dissectors/packet-dtn.c by checking whether SDNV     evaluation was successful (bsc#1010740).

  - CVE-2016-9374: In Wireshark the AllJoyn dissector could     crash with a buffer over-read, triggered by network     traffic or a capture file. This was addressed in     epan/dissectors/packet-alljoyn.c by ensuring that a     length variable properly tracked the state of a     signature variable (bsc#1010752).

  - CVE-2016-9373: In Wireshark the DCERPC dissector could     crash with a use-after-free, triggered by network     traffic or a capture file. This was addressed in     epan/dissectors/packet-dcerpc-nt.c and     epan/dissectors/packet-dcerpc-spoolss.c by using the     wmem file scope for private strings (bsc#1010754).

  - CVE-2016-7175: epan/dissectors/packet-qnet6.c in the     QNX6 QNET dissector in Wireshark mishandled MAC address     data, which allowed remote attackers to cause a denial     of service (out-of-bounds read and application crash)     via a crafted packet (bsc#998761).

  - CVE-2016-7176: epan/dissectors/packet-h225.c in the     H.225 dissector in Wireshark called snprintf with one of     its input buffers as the output buffer, which allowed     remote attackers to cause a denial of service (copy     overlap and application crash) via a crafted packet     (bsc#998762).

  - CVE-2016-7177: epan/dissectors/packet-catapult-dct2000.c     in the Catapult DCT2000 dissector in Wireshark did not     restrict the number of channels, which allowed remote     attackers to cause a denial of service (buffer over-read     and application crash) via a crafted packet     (bsc#998763).

  - CVE-2016-7180: epan/dissectors/packet-ipmi-trace.c in     the IPMI trace dissector in Wireshark did not properly     consider whether a string is constant, which allowed     remote attackers to cause a denial of service     (use-after-free and application crash) via a crafted     packet (bsc#998800).

  - CVE-2016-7178: epan/dissectors/packet-umts_fp.c in the     UMTS FP dissector in Wireshark did not ensure that     memory is allocated for certain data structures, which     allowed remote attackers to cause a denial of service     (invalid write access and application crash) via a     crafted packet (bsc#998964).

  - CVE-2017-6014: In Wireshark a crafted or malformed     STANAG 4607 capture file will cause an infinite loop and     memory exhaustion. If the packet size field in a packet     header is null, the offset to read from will not     advance, causing continuous attempts to read the same     zero length packet. This will quickly exhaust all system     memory (bsc#1025913).

  - CVE-2017-5596: In Wireshark the ASTERIX dissector could     go into an infinite loop, triggered by packet injection     or a malformed capture file. This was addressed in     epan/dissectors/packet-asterix.c by changing a data type     to avoid an integer overflow (bsc#1021739).

  - CVE-2017-5597: In Wireshark the DHCPv6 dissector could     go into a large loop, triggered by packet injection or a     malformed capture file. This was addressed in     epan/dissectors/packet-dhcpv6.c by changing a data type     to avoid an integer overflow (bsc#1021739).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to Wireshark 2.2.6 fixes minor vulnerabilities that could be used to trigger a dissector crash or infinite loops by sending specially crafted packages over the network or into a capture file :

  - CVE-2017-7700: NetScaler file parser infinite loop     (boo#1033936)

  - CVE-2017-7701: BGP dissector infinite loop (boo#1033937)

  - CVE-2017-7702: WBMXL dissector infinite loop     (boo#1033938)

  - CVE-2017-7703: IMAP dissector crash (boo#1033939)

  - CVE-2017-7704: DOF dissector infinite loop (boo#1033940)

  - CVE-2017-7705: RPCoRDMA dissector infinite loop     (boo#1033941)

  - CVE-2017-7745: SIGCOMP dissector infinite loop     (boo#1033942)

  - CVE-2017-7746: SLSK dissector long loop (boo#1033943)

  - CVE-2017-7747: PacketBB dissector crash (boo#1033944)

  - CVE-2017-7748: WSP dissector infinite loop (boo#1033945)

The version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.12 or 2.2.x prior to 2.2.6. It is, therefore, affected by multiple denial of service vulnerabilities :

  - An infinite loop condition condition exists in the     NetScaler file parser within file wiretap/netscaler.c     when handling specially crafted capture files. An     unauthenticated, remote attacker can exploit this to     cause excessive consumption of CPU resources, resulting     in a denial of service condition. (CVE-2017-7700)

  - An infinite loop condition condition exists in the BGP     dissector within file epan/dissectors/packet-bgp.c when     handling specially crafted packets or trace files. An     unauthenticated, remote attacker can exploit this to     cause excessive consumption of CPU resources, resulting     in a denial of service condition. (CVE-2017-7701)

  - An infinite loop condition condition exists in the WBXML     dissector within file epan/dissectors/packet-wbxml.c     when handling specially crafted packets or trace files.
    An unauthenticated, remote attacker can exploit this to     cause excessive consumption of CPU resources, resulting     in a denial of service condition. (CVE-2017-7702)

  - A denial of service vulnerability exists in the IMAP     dissector within file epan/dissectors/packet-imap.c when     handling specially crafted packets or trace files. An     unauthenticated, remote attacker can exploit this to     crash the program. (CVE-2017-7703)

  - An infinite loop condition condition exists in the DOF     dissector within file epan/dissectors/packet-dof.c when     handling specially crafted packets or trace files. An     unauthenticated, remote attacker can exploit this to     cause excessive consumption of CPU resources, resulting     in a denial of service condition. Note that this issue     only applies to the 2.2.x version. (CVE-2017-7704)

  - An infinite loop condition condition exists in the RPC     over RDMA dissector within file     epan/dissectors/packet-rpcrdma.c when handling specially     crafted packets or trace files. An unauthenticated,     remote attacker can exploit this to cause excessive     consumption of CPU resources, resulting in a denial of     service condition. (CVE-2017-7705)

  - An infinite loop condition condition exists in the     SIGCOMP dissector within file     epan/dissectors/packet-sigcomp.c when handling specially     crafted packets or trace files. An unauthenticated,     remote attacker can exploit this to cause excessive     consumption of CPU resources, resulting in a denial of     service condition. (CVE-2017-7745)

  - An infinite loop condition condition exists in the     SLSK dissector in the dissect_slsk_pdu() function within     file epan/dissectors/packet-slsk.c, when handling     specially crafted packets or trace files. An     unauthenticated, remote attacker can exploit this to     cause excessive consumption of CPU resources, resulting     in a denial of service condition. (CVE-2017-7746)

  - An out-of-bounds read error exists in the PacketBB     dissector in the dissect_pbb_addressblock() function     within file epan/dissectors/packet-packetbb.c when     handling specially crafted packets or trace files. An     unauthenticated, remote attacker can exploit this to     crash the program. (CVE-2017-7747)

  - An infinite loop condition condition exists in the WSP     dissector within file epan/dissectors/packet-wsp.c when     handling specially crafted packets or trace files. An     unauthenticated, remote attacker can exploit this to     cause excessive consumption of CPU resources, resulting     in a denial of service condition. (CVE-2017-7748)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote macOS or Mac OS X host is 2.0.x prior to 2.0.12 or 2.2.x prior to 2.2.6. It is, therefore, affected by multiple denial of service vulnerabilities :

  - An infinite loop condition condition exists in the     NetScaler file parser within file wiretap/netscaler.c     when handling specially crafted capture files. An     unauthenticated, remote attacker can exploit this to     cause excessive consumption of CPU resources, resulting     in a denial of service condition. (CVE-2017-7700)

  - An infinite loop condition condition exists in the BGP     dissector within file epan/dissectors/packet-bgp.c when     handling specially crafted packets or trace files. An     unauthenticated, remote attacker can exploit this to     cause excessive consumption of CPU resources, resulting     in a denial of service condition. (CVE-2017-7701)

  - An infinite loop condition condition exists in the WBXML     dissector within file epan/dissectors/packet-wbxml.c     when handling specially crafted packets or trace files.
    An unauthenticated, remote attacker can exploit this to     cause excessive consumption of CPU resources, resulting     in a denial of service condition. (CVE-2017-7702)

  - A denial of service vulnerability exists in the IMAP     dissector within file epan/dissectors/packet-imap.c when     handling specially crafted packets or trace files. An     unauthenticated, remote attacker can exploit this to     crash the program. (CVE-2017-7703)

  - An infinite loop condition condition exists in the DOF     dissector within file epan/dissectors/packet-dof.c when     handling specially crafted packets or trace files. An     unauthenticated, remote attacker can exploit this to     cause excessive consumption of CPU resources, resulting     in a denial of service condition. Note that this issue     only applies to the 2.2.x version. (CVE-2017-7704)

  - An infinite loop condition condition exists in the RPC     over RDMA dissector within file     epan/dissectors/packet-rpcrdma.c when handling specially     crafted packets or trace files. An unauthenticated,     remote attacker can exploit this to cause excessive     consumption of CPU resources, resulting in a denial of     service condition. (CVE-2017-7705)

  - An infinite loop condition condition exists in the     SIGCOMP dissector within file     epan/dissectors/packet-sigcomp.c when handling specially     crafted packets or trace files. An unauthenticated,     remote attacker can exploit this to cause excessive     consumption of CPU resources, resulting in a denial of     service condition. (CVE-2017-7745)

  - An infinite loop condition condition exists in the     SLSK dissector in the dissect_slsk_pdu() function within     file epan/dissectors/packet-slsk.c, when handling     specially crafted packets or trace files. An     unauthenticated, remote attacker can exploit this to     cause excessive consumption of CPU resources, resulting     in a denial of service condition. (CVE-2017-7746)

  - An out-of-bounds read error exists in the PacketBB     dissector in the dissect_pbb_addressblock() function     within file epan/dissectors/packet-packetbb.c when     handling specially crafted packets or trace files. An     unauthenticated, remote attacker can exploit this to     crash the program. (CVE-2017-7747)

  - An infinite loop condition condition exists in the WSP     dissector within file epan/dissectors/packet-wsp.c when     handling specially crafted packets or trace files. An     unauthenticated, remote attacker can exploit this to     cause excessive consumption of CPU resources, resulting     in a denial of service condition. (CVE-2017-7748)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
121193	Debian DLA-1634-1 : wireshark security update	Nessus	Debian Local Security Checks	high
100655	GLSA-201706-12 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
100539	SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2017:1442-1)	Nessus	SuSE Local Security Checks	high
99991	SUSE SLES11 Security Update : wireshark (SUSE-SU-2017:1174-1)	Nessus	SuSE Local Security Checks	high
99617	openSUSE Security Update : wireshark (openSUSE-2017-503)	Nessus	SuSE Local Security Checks	high
99437	Wireshark 2.0.x < 2.0.12 / 2.2.x < 2.2.6 Multiple DoS	Nessus	Windows	high
99436	Wireshark 2.0.x < 2.0.12 / 2.2.x < 2.2.6 Multiple DoS (macOS)	Nessus	MacOS X Local Security Checks	high

CVE-2017-7703

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins