CERT-In Advisory CIAD-2007-35
Wireshark (Ethereal) Multiple Protocol Vulnerabilities
Original issue date:
June 29, 2007
Severity Rating: Medium
System Affected
- Wireshark (Ethereal) versions 0.10.14 through 0.99.5
Overview
Multiple vulnerabilities have been reported in Wireshark (Ethereal) while reading malformed packet off the network which could be exploited by remote attackers to cause denial of service attack on the affected system.
Description
Wireshark (Ethereal) is a program for monitoring network traffic. Each protocol supported by it is handled through a bit of code known as a dissector.
1. Wireshark (Ethereal) denial of service vulnerability (CVE-2007-3389)
A vulnerability has been reported in Wireshark which could be exploited by remote attacker while processing malformed HTTP chunked responses to cause denial of service or crash the affected system.
2. Wireshark (Ethereal) SIGTRAP error (CVE-2007-3390)
A vulnerability exist in Wireshark which could be exploited by remote attacker to cause a denial of service (crash) via crafted iSeries capture files that trigger a SIGTRAP.
3. Wireshark (Ethereal) infinite loop error (CVE-2007-3391)
A vulnerability has been reported in Wireshark (Ethereal) which could be exploited by remote attacker to cause denial of service via a malformed DCP ETSI packet that triggers an infinite loop.
4. Wireshark (Ethereal) infinite loop error (CVE-2007-3392)
A vulnerability has been reported in Wireshark which could be exploited by remote attacker to cause a denial of service attack via malformed SSL or MMS packets that trigger an infinite loop.
5. Off-by-One error in DHCP/BOOTP Dissector (CVE-2007-3393 )
A vulnerability has been reported in Wireshark due to Off-by-one error in the DHCP/BOOTP dissector which could be exploited by remote attackers to cause a denial of service attack via crafted DHCP-over-DOCSIS packets.
Solution
Update to version 0.99.6.
http://www.wireshark.org/docs/relnotes/wireshark-0.99.6.html
References
WireShark
http://www.wireshark.org/docs/relnotes/wireshark-0.99.6.html http://www.wireshark.org/security/wnpa-sec-2007-02.html
FrSirt
http://www.frsirt.com/english/advisories/2007/2353
Secunia
http://secunia.com/advisories/25833/
Securityfocus
http://www.securityfocus.com/bid/24662
CVE-Name
CVE-2007-3389
CVE-2007-3390
CVE-2007-3391
CVE-2007-3392
CVE-2007-3393
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Communications and Information Technology
Electronics Niketan
6, C.G.O. Complex
New Delhi-110 003
|
