Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet injection or crafted capture file

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet     injection or crafted capture file (CVE-2021-22222)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet
    injection or crafted capture file (CVE-2021-22222)

The remote host is affected by the vulnerability described in GLSA-202107-21 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5019 advisory.

  - Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows     denial of service via packet injection or crafted capture file (CVE-2021-22207)

  - Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet     injection or crafted capture file (CVE-2021-22222)

  - Crash in DNP dissector in Wireshark 3.4.0 to 3.4.6 and 3.2.0 to 3.2.14 allows denial of service via packet     injection or crafted capture file (CVE-2021-22235)

  - NULL pointer exception in the IPPUSB dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via     packet injection or crafted capture file (CVE-2021-39920)

  - NULL pointer exception in the Modbus dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows     denial of service via packet injection or crafted capture file (CVE-2021-39921)

  - Buffer overflow in the C12.22 dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of     service via packet injection or crafted capture file (CVE-2021-39922)

  - Large loop in the PNRP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service     via packet injection or crafted capture file (CVE-2021-39923)

  - Large loop in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of     service via packet injection or crafted capture file (CVE-2021-39924)

  - Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows     denial of service via packet injection or crafted capture file (CVE-2021-39925)

  - Buffer overflow in the Bluetooth HCI_ISO dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service     via packet injection or crafted capture file (CVE-2021-39926)

  - NULL pointer exception in the IEEE 802.11 dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows     denial of service via packet injection or crafted capture file (CVE-2021-39928)

  - Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17     allows denial of service via packet injection or crafted capture file (CVE-2021-39929)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the wireshark package has been released.

ID	Name	Product	Family	Severity
258788	Linux Distros Unpatched Vulnerability : CVE-2021-22222	Nessus	Misc.	high
427688	Alpine: multiple wireshark packages, tshark: security update to 3.4.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427688	Alpine: multiple wireshark packages, tshark: security update to 3.4.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
157006	GLSA-202107-21 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
156013	Debian DSA-5019-1 : wireshark - security update	Nessus	Debian Local Security Checks	high
151433	Photon OS 4.0: Wireshark PHSA-2021-4.0-0055	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2021-22222

high

Tenable Plugins

high

high

high

high

high

high