CERT-In Advisory
CIAD-2012-0043
Multiple Vulnerabilities in Wireshark
Original Issue Date: September 03, 2012
Severity Rating: High
Systems Affected
- Wireshark versions prior to 1.4.15
- Wireshark versions prior to 1.6.10
- Wireshark versions prior to 1.8.2
Overview
Multiple vulnerabilities have been reported in Wireshark, which allow a remote attacker to execute an arbitrary code or cause a denial of service conditions.
Description
1. Wireshark DCP ETSI zero division vulnerability
(
CVE-2012-4285
)
This vulnerability exists in Wireshark due to a divide by zero error in the DCP ETSI dissector. A remote attacker could exploit this vulnerability by convincing a user to read a malformed packet trace file. Successful exploitation of this vulnerability may allow to cause a denial of service (divide-by-zero error and application crash) via a zero-length message.
2. Wireshark pcap-ng file parser zero division vulnerability
(
CVE-2012-4286
)
This vulnerability exists in Wireshark due to a divide by zero error in the pcap-ng file parser. A remote attacker could exploit this vulnerability by convincing a user to read a malformed packet trace file. Successful exploitation of this vulnerability may allow to cause a denial of service (divide-by-zero error and application crash) via a crafted pcap-ng file.
3. Wireshark MongoDB large loop vulnerability
(
CVE-2012-4287
)
This vulnerability exists in Wireshark due to the MongoDB dissector could go into a large loop. A remote attacker could exploit this vulnerability by convincing a user to read a malformed packet trace file. Successful exploitation of this vulnerability may allow to cause a denial of service (consume excessive CPU resources).
4. Wireshark XTP dissector large loop vulnerability
(
CVE-2012-4288
)
This vulnerability exists in Wireshark due to the XTP dissector could go into an infinite loop. A remote attacker could exploit this vulnerability by convincing a user to read a malformed packet trace file. Successful exploitation of this vulnerability may allow to cause a denial of service (consume excessive CPU resources).
5. Wireshark AFP dissector large loop vulnerability
(
CVE-2012-4289
)
This vulnerability exists in Wireshark due to the AFP dissector could go into a large loop. A remote attacker could exploit this vulnerability by convincing a user to read a malformed packet trace file. Successful exploitation of this vulnerability may allow to cause a denial of service (consume excessive CPU resources).
6. Wireshark CTDB dissector large loop vulnerability
(
CVE-2012-4290
)
This vulnerability exists in Wireshark due to the CTDB dissector could go into a large loop. A remote attacker could exploit this vulnerability by convincing a user to read a malformed packet trace file. Successful exploitation of this vulnerability may allow to cause a denial of service (consume excessive CPU resources).
7. Wireshark CIP dissector memory exhaustion vulnerability
(
CVE-2012-4291
)
This vulnerability exists in Wireshark due to the CIP dissector could exhaust system memory. A remote attacker could exploit this vulnerability by convincing a user to read a malformed packet trace file. Successful exploitation of this vulnerability may allow to cause a denial of service (consume excessive CPU resources).
8. Wireshark STUN dissector crash vulnerability
(
CVE-2012-4292
)
This vulnerability exists in Wireshark due to the STUN dissector does not properly interact with key-destruction behaviour in a certain tree library . A remote attacker could exploit this vulnerability by convincing a user to read a malformed packet trace file. Successful exploitation of this vulnerability may allow to cause a denial of service (application crash) via a malformed packet.
9. Wireshark EtherCAT Mailbox dissector abort vulnerability
(
CVE-2012-4293
)
This vulnerability exists in Wireshark due to an error within the EtherCAT Mailbox dissector. A remote attacker could exploit this vulnerability by convincing a user to read a malformed packet trace file. Successful exploitation of this vulnerability may allow to cause a denial of service (application exit).
10. Wireshark ERF dissector vulnerabilities
(
CVE-2012-4294
CVE-2012-4295
)
These vulnerabilities exists in Wireshark due to a buffer overflow in the ERF dissector. A remote attacker could exploit this vulnerability to execute arbitrary code on the target system by convincing a user to read a malformed packet trace file. Successful exploitation of this vulnerability may allow execution of arbitrary code and to cause a denial of service (application crash) .
11. Wireshark RTPS2 dissector buffer overflow vulnerability
(
CVE-2012-4296
)
This vulnerability exists in Wireshark due to a buffer overflow in the RTPS2 dissector. A remote attacker could exploit this vulnerability to execute arbitrary code on the target system by convincing a user to read a malformed packet trace file. Successful exploitation of this vulnerability may allow to cause a denial of service (consume excessive CPU resources).
12. Wireshark GSM RLC MAC dissector buffer overflow vulnerability
(
CVE-2012-4297
)
This vulnerability exists in Wireshark due to a buffer overflow in the GSM RLC MAC dissector. A remote attacker could exploit this vulnerability to execute arbitrary code on the target system by convincing a user to read a malformed packet trace file. Successful exploitation of this vulnerability may allow to cause a denial of service (application crash) via a malformed packet.
13. Wireshark Ixia IxVeriWave file parser buffer overflow vulnerability
(
CVE-2012-4298
)
This vulnerability exists in Wireshark due to a buffer overflow in the Ixia IxVeriWave file parser. A remote attacker could exploit this vulnerability to execute arbitrary code on the target system by convincing a user to read a malformed packet trace file. Successful exploitation of this vulnerability may allow to cause a denial of service (application crash) via a malformed packet.
Solution
Update to version 1.8.2, 1.6.10, or 1.4.15.
www.wireshark.org/security/wnpa-sec-2012-14.html
Vendor Information
Wireshark
http://www.wireshark.org/security/wnpa-sec-2012-14.html
http://www.wireshark.org/security/wnpa-sec-2012-15.html
http://www.wireshark.org/security/wnpa-sec-2012-16.html
http://www.wireshark.org/security/wnpa-sec-2012-17.html
http://www.wireshark.org/security/wnpa-sec-2012-18.html
http://www.wireshark.org/security/wnpa-sec-2012-19.html
http://www.wireshark.org/security/wnpa-sec-2012-20.html
http://www.wireshark.org/security/wnpa-sec-2012-21.html
http://www.wireshark.org/security/wnpa-sec-2012-22.html
http://www.wireshark.org/security/wnpa-sec-2012-23.html
http://www.wireshark.org/security/wnpa-sec-2012-24.html
http://www.wireshark.org/security/wnpa-sec-2012-25.html
References
Security Tracker
http://securitytracker.com/id/1027404
Secunia
http://secunia.com/advisories/50276/
Secure list
http://www.securelist.com/en/advisories/50276
CVE Name
CVE-2012-4285
CVE-2012-4286
CVE-2012-4287
CVE-2012-4288
CVE-2012-4289
CVE-2012-4290
CVE-2012-4291
CVE-2012-4292
CVE-2012-4293
CVE-2012-4294
CVE-2012-4295
CVE-2012-4296
CVE-2012-4297
CVE-2012-4298
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|