Mandriva Linux Security Advisory : wireshark (MDVSA-2013:238)

This script is Copyright (C) 2013 Tenable Network Security, Inc.


Synopsis :

The remote Mandriva Linux host is missing one or more security
updates.

Description :

Multiple vulnerabilities was found and corrected in Wireshark :

The dissect_nbap_T_dCH_ID function in epan/dissectors/packet-nbap.c in
the NBAP dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before
1.10.2 does not restrict the dch_id value, which allows remote
attackers to cause a denial of service (application crash) via a
crafted packet (CVE-2013-5718).

epan/dissectors/packet-assa_r3.c in the ASSA R3 dissector in Wireshark
1.8.x before 1.8.10 and 1.10.x before 1.10.2 allows remote attackers
to cause a denial of service (infinite loop) via a crafted packet
(CVE-2013-5719).

Buffer overflow in the RTPS dissector in Wireshark 1.8.x before 1.8.10
and 1.10.x before 1.10.2 allows remote attackers to cause a denial of
service (application crash) via a crafted packet (CVE-2013-5720).

The dissect_mq_rr function in epan/dissectors/packet-mq.c in the MQ
dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2
does not properly determine when to enter a certain loop, which allows
remote attackers to cause a denial of service (application crash) via
a crafted packet (CVE-2013-5721).

Unspecified vulnerability in the LDAP dissector in Wireshark 1.8.x
before 1.8.10 and 1.10.x before 1.10.2 allows remote attackers to
cause a denial of service (application crash) via a crafted packet
(CVE-2013-5722).

This advisory provides the latest supported version of Wireshark
(1.8.10) which is not vulnerable to these issues.

See also :

https://www.wireshark.org/security/wnpa-sec-2013-55.html
https://www.wireshark.org/security/wnpa-sec-2013-56.html
https://www.wireshark.org/security/wnpa-sec-2013-57.html
https://www.wireshark.org/security/wnpa-sec-2013-58.html
https://www.wireshark.org/security/wnpa-sec-2013-59.html

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 4.3
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Mandriva Local Security Checks

Nessus Plugin ID: 70004 ()

Bugtraq ID: 62315
62318
62319
62320
62321

CVE ID: CVE-2013-5718
CVE-2013-5719
CVE-2013-5720
CVE-2013-5721
CVE-2013-5722

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now