Wireshark version 1.4.2 fixes several security issues that allowed attackers to crash wireshark or potentially even execute arbitrary code

(CVE-2010-1455, CVE-2010-2283, CVE-2010-2284, CVE-2010-2285, CVE-2010-2286, CVE-2010-2287, CVE-2010-2992, CVE-2010-2993, CVE-2010-2994, CVE-2010-2995, CVE-2010-3445, CVE-2010-4300, CVE-2010-4301)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-417:02 advisory.

    This package lays base for libpcap, a packet capture and filtering library, contains command-line     utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged     separately to GTK+ package.
    Security issues fixed with this release:
    CVE-2010-1455     The DOCSIS dissector in Wireshark 0.9.6 through 1.0.12 and 1.2.0 through 1.2.7 allows user-assisted remote     attackers to cause a denial of service (application crash) via a malformed packet trace file.
    CVE-2010-2283     The SMB dissector in Wireshark 0.99.6 through 1.0.13, and 1.2.0 through 1.2.8 allows remote attackers to     cause a denial of service (NULL pointer dereference) via unknown vectors.
    CVE-2010-2284     Buffer overflow in the ASN.1 BER dissector in Wireshark 0.10.13 through 1.0.13 and 1.2.0 through 1.2.8 has     unknown impact and remote attack vectors.
    CVE-2010-2286     The SigComp Universal Decompressor Virtual Machine dissector in Wireshark 0.10.7 through 1.0.13 and 1.2.0     through 1.2.8 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.
    CVE-2010-2287     Buffer overflow in the SigComp Universal Decompressor Virtual Machine dissector in Wireshark 0.10.8     through 1.0.13 and 1.2.0 through 1.2.8 has unknown impact and remote attack vectors.
    CVE-2010-2995     The SigComp Universal Decompressor Virtual Machine (UDVM) in Wireshark 0.10.8 through 1.0.14 and 1.2.0     through 1.2.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary     code via vectors related to sigcomp-udvm.c and an off-by-one error, which triggers a buffer overflow, a     different vulnerability than CVE-2010-2287.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This advisory updates wireshark to the latest version(s), fixing several security issues :

The SMB dissector in Wireshark 0.99.6 through 1.0.13, and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (NULL pointer dereference) via unknown vectors (CVE-2010-2283).

Buffer overflow in the ASN.1 BER dissector in Wireshark 0.10.13 through 1.0.13 and 1.2.0 through 1.2.8 has unknown impact and remote attack vectors (CVE-2010-2284).

The SMB PIPE dissector in Wireshark 0.8.20 through 1.0.13 and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (NULL pointer dereference) via unknown vectors (CVE-2010-2285).

The SigComp Universal Decompressor Virtual Machine dissector in Wireshark 0.10.7 through 1.0.13 and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors (CVE-2010-2286).

Buffer overflow in the SigComp Universal Decompressor Virtual Machine dissector in Wireshark 0.10.8 through 1.0.13 and 1.2.0 through 1.2.8 has unknown impact and remote attack vectors (CVE-2010-2287).

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Multiple buffer overflow flaws were found in the Wireshark SigComp Universal Decompressor Virtual Machine (UDVM) dissector. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2010-2287, CVE-2010-2995)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2010-1455, CVE-2010-2283, CVE-2010-2284, CVE-2010-2286)

Users of Wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.15, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.

ID	Name	Product	Family	Published	Updated	Severity
75771	openSUSE Security Update : wireshark (openSUSE-SU-2011:0010-2)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	critical
284145	MiracleLinux 3 : wireshark-1.0.15-1.1.0.1.AXS3 (AXSA:2010-417:02)	Nessus	Miracle Linux Local Security Checks	1/14/2026	2/12/2026	high
48186	Mandriva Linux Security Advisory : wireshark (MDVSA-2010:113)	Nessus	Mandriva Local Security Checks	7/30/2010	1/6/2021	critical
48409	CentOS 4 / 5 : wireshark (CESA-2010:0625)	Nessus	CentOS Local Security Checks	8/24/2010	1/4/2021	critical
53689	openSUSE Security Update : wireshark (openSUSE-SU-2011:0010-1)	Nessus	SuSE Local Security Checks	5/5/2011	1/14/2021	critical
53808	openSUSE Security Update : wireshark (openSUSE-SU-2011:0010-2)	Nessus	SuSE Local Security Checks	5/5/2011	1/14/2021	critical

Detections

Analytics

Plugins Search

critical

high

critical

critical

critical

critical