Detections
Analytics
Wireshark 1.4.x < 1.4.11 Multiple Vulnerabilities
high Nessus Plugin ID 57538
Language:
Synopsis
An application installed on the remote Windows host is affected by multiple vulnerabilities.Description
The version of Wireshark installed on the remote Windows host is prior to 1.4.11. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.4.11 advisory.- Laurent Butti discovered that Wireshark failed to properly check record sizes for many packet capture file formats. It may be possible to make Wireshark crash by convincing someone to read a malformed packet trace file. (wireshark-bug-6663, wireshark-bug-6666, wireshark-bug-6667, wireshark-bug-6668, wireshark-bug-6669, wireshark-bug-6670)
- Wireshark was improperly handling NULL pointers when displaying packet information which could lead to a crash. It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. (wireshark-bug-6634)
- The RLC dissector could overflow a buffer. It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. (wireshark- bug-6391)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Wireshark version 1.4.11 or later.See Also
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6391
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6634
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6663
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6666
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6667
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6668
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6669
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6670
https://www.wireshark.org/docs/relnotes/wireshark-1.4.11.html
https://www.wireshark.org/security/wnpa-sec-2012-01
Plugin Details
Severity: High
ID: 57538
File Name: wireshark_1_4_11.nasl
Version: 1.14
Type: Local
Agent: windows
Family: Windows
Published: 1/13/2012
Updated: 10/7/2026
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
Vulnerability Information
CPE: cpe:/a:wireshark:wireshark
Required KB Items: SMB/Registry/Enumerated, installed_sw/Wireshark
Exploit Ease: No known exploits are available
Patch Publication Date: 1/10/2012
Vulnerability Publication Date: 1/10/2012