Wireshark 2.0.x < 2.0.14 / 2.2.x < 2.2.8 Multiple DoS

High Nessus Plugin ID 101898

Synopsis

An application installed on the remote Windows host is affected by multiple denial of service vulnerabilities.

Description

The version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.14 or 2.2.x prior to 2.2.8. It is, therefore, affected by multiple denial of service vulnerabilities :

- A denial of service vulnerability exists in the DAAP dissector, specifically in the dissect_daap_one_tag() function within file epan/dissectors/packet-daap.c. An unauthenticated, remote attacker can exploit this to exhaust stack resources through uncontrolled recursion.
(CVE-2017-9617)

- An infinite loop condition exists in the DOCSIS dissector, specifically in the dissect_docsis() function within file plugins/docsis/packet-docsis.c. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to consume available CPU resources, resulting in a denial of service condition. (CVE-2017-11406)

- A memory allocation issue exists in the MQ dissector, specifically in the reassemble_mq() function within file epan/dissectors/packet-mq.c, due to improper validation of fragment lengths before attempting reassembly. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a denial of service condition. (CVE-2017-11407)

- A flaw exists in the AMQP dissector, specifically in the get_amqp_1_0_value_formatter() function within file epan/dissectors/packet-amqp.c, when decoding lists.
An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a stack overflow, resulting in a denial of service condition. (CVE-2017-11408)

- A large loop condition exists in the GPRS LLC dissector, specifically in the llc_gprs_dissect_xid() function within file epan/dissectors/packet-gprs-llc.c, when handling specially crafted packet or trace files. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. Note that this issue only applies to version 2.0.x. (CVE-2017-11409)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Wireshark version 2.0.14 / 2.2.8 or later.

See Also

https://www.wireshark.org/docs/relnotes/wireshark-2.0.14.html

https://www.wireshark.org/docs/relnotes/wireshark-2.2.8.html

https://www.wireshark.org/security/wnpa-sec-2017-34.html

https://www.wireshark.org/security/wnpa-sec-2017-35.html

https://www.wireshark.org/security/wnpa-sec-2017-36.html

https://www.wireshark.org/security/wnpa-sec-2017-37.html

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13799

Plugin Details

Severity: High

ID: 101898

File Name: wireshark_2_2_8.nasl

Version: 1.5

Type: local

Agent: windows

Family: Windows

Published: 2017/07/21

Updated: 2018/08/07

Dependencies: 34112

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:wireshark:wireshark

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2017/07/18

Vulnerability Publication Date: 2017/04/15

Reference Information

CVE: CVE-2017-9617, CVE-2017-11406, CVE-2017-11407, CVE-2017-11408, CVE-2017-11409

BID: 99087