Executive Summary
Summary | |
---|---|
Title | New Wireshark packages fix several vulnerabilities |
Informations | |||
---|---|---|---|
Name | DSA-1983 | First vendor Publication | 2010-01-30 |
Vendor | Debian | Last vendor Modification | 2010-01-30 |
Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-4337 A NULL pointer dereference was found in the SMB/SMB2 dissectors. CVE-2010-0304 Several buffer overflows were found in the LWRES dissector. For the stable distribution (lenny), this problem has been fixed in version 1.0.2-3+lenny8. For the unstable distribution (sid) these problems have been fixed in version 1.2.6-1. We recommend that you upgrade your Wireshark packages. |
Original Source
Url : http://www.debian.org/security/2010/dsa-1983 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
50 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
50 % | CWE-89 | Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:13361 | |||
Oval ID: | oval:org.mitre.oval:def:13361 | ||
Title: | DSA-1983-1 wireshark -- several | ||
Description: | Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-4337 A NULL pointer dereference was found in the SMB/SMB2 dissectors. CVE-2010-0304 Several buffer overflows were found in the LWRES dissector. For the stable distribution, this problem has been fixed in version 1.0.2-3+lenny8. For the unstable distribution these problems have been fixed in version 1.2.6-1. We recommend that you upgrade your Wireshark packages. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1983-1 CVE-2009-4377 CVE-2010-0304 | Version: | 5 |
Platform(s): | Debian GNU/Linux 5.0 | Product(s): | wireshark |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:21253 | |||
Oval ID: | oval:org.mitre.oval:def:21253 | ||
Title: | RHSA-2010:0360: wireshark security update (Moderate) | ||
Description: | Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2010:0360-01 CESA-2010:0360 CVE-2009-2560 CVE-2009-2562 CVE-2009-2563 CVE-2009-3550 CVE-2009-3829 CVE-2009-4377 CVE-2010-0304 | Version: | 94 |
Platform(s): | Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 3 CentOS Linux 5 | Product(s): | wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:22891 | |||
Oval ID: | oval:org.mitre.oval:def:22891 | ||
Title: | ELSA-2010:0360: wireshark security update (Moderate) | ||
Description: | Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2010:0360-01 CVE-2009-2560 CVE-2009-2562 CVE-2009-2563 CVE-2009-3550 CVE-2009-3829 CVE-2009-4377 CVE-2010-0304 | Version: | 33 |
Platform(s): | Oracle Linux 5 | Product(s): | wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:25534 | |||
Oval ID: | oval:org.mitre.oval:def:25534 | ||
Title: | NULL pointer dereference vulnerability in Wireshark via crafted packet | ||
Description: | The (1) SMB and (2) SMB2 dissectors in Wireshark 0.9.0 through 1.2.4 allow remote attackers to cause a denial of service (crash) via a crafted packet that triggers a NULL pointer dereference, as demonstrated by fuzz-2009-12-07-11141.pcap. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2009-4377 | Version: | 4 |
Platform(s): | Microsoft Windows XP Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows Server 2012 Microsoft Windows 8.1 Microsoft Windows Server 2012 R2 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7075 | |||
Oval ID: | oval:org.mitre.oval:def:7075 | ||
Title: | DSA-1983 wireshark -- several vulnerabilities | ||
Description: | Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems: A NULL pointer dereference was found in the SMB/SMB2 dissectors. Several buffer overflows were found in the LWRES dissector. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1983 CVE-2009-4377 CVE-2010-0304 | Version: | 5 |
Platform(s): | Debian GNU/Linux 5.0 | Product(s): | wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:8490 | |||
Oval ID: | oval:org.mitre.oval:def:8490 | ||
Title: | Wireshark Dissector LWRES Multiple Buffer Overflow Vulnerabilities | ||
Description: | Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-0304 | Version: | 10 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:9564 | |||
Oval ID: | oval:org.mitre.oval:def:9564 | ||
Title: | The (1) SMB and (2) SMB2 dissectors in Wireshark 0.9.0 through 1.2.4 allow remote attackers to cause a denial of service (crash) via a crafted packet that triggers a NULL pointer dereference, as demonstrated by fuzz-2009-12-07-11141.pcap. | ||
Description: | The (1) SMB and (2) SMB2 dissectors in Wireshark 0.9.0 through 1.2.4 allow remote attackers to cause a denial of service (crash) via a crafted packet that triggers a NULL pointer dereference, as demonstrated by fuzz-2009-12-07-11141.pcap. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-4377 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:9933 | |||
Oval ID: | oval:org.mitre.oval:def:9933 | ||
Title: | Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function. | ||
Description: | Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2010-0304 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
SAINT Exploits
Description | Link |
---|---|
Wireshark LWRES dissector buffer overflow | More info here |
OpenVAS Exploits
Date | Description |
---|---|
2011-08-09 | Name : CentOS Update for wireshark CESA-2010:0360 centos5 i386 File : nvt/gb_CESA-2010_0360_wireshark_centos5_i386.nasl |
2011-03-09 | Name : Gentoo Security Advisory GLSA 201006-05 (wireshark) File : nvt/glsa_201006_05.nasl |
2010-04-29 | Name : CentOS Update for wireshark CESA-2010:0360 centos3 i386 File : nvt/gb_CESA-2010_0360_wireshark_centos3_i386.nasl |
2010-04-29 | Name : CentOS Update for wireshark CESA-2010:0360 centos4 i386 File : nvt/gb_CESA-2010_0360_wireshark_centos4_i386.nasl |
2010-04-29 | Name : RedHat Update for wireshark RHSA-2010:0360-01 File : nvt/gb_RHSA-2010_0360-01_wireshark.nasl |
2010-03-05 | Name : Fedora Update for wireshark FEDORA-2010-3556 File : nvt/gb_fedora_2010_3556_wireshark_fc12.nasl |
2010-02-10 | Name : Debian Security Advisory DSA 1983-1 (wireshark) File : nvt/deb_1983_1.nasl |
2010-02-10 | Name : FreeBSD Ports: wireshark, wireshark-lite File : nvt/freebsd_wireshark3.nasl |
2010-02-08 | Name : Mandriva Update for wireshark MDVSA-2010:031 (wireshark) File : nvt/gb_mandriva_MDVSA_2010_031.nasl |
2010-02-08 | Name : Wireshark Multiple Buffer Overflow Vulnerabilities (Linux) File : nvt/gb_wireshark_mult_bof_vuln_lin.nasl |
2010-02-08 | Name : Wireshark Multiple Buffer Overflow Vulnerabilities (Win) File : nvt/gb_wireshark_mult_bof_vuln_win.nasl |
2010-01-20 | Name : Mandriva Update for wireshark MDVSA-2010:016 (wireshark) File : nvt/gb_mandriva_MDVSA_2010_016.nasl |
2009-12-30 | Name : Fedora Core 12 FEDORA-2009-13592 (wireshark) File : nvt/fcore_2009_13592.nasl |
2009-12-24 | Name : Wireshark SMB Dissectors Denial of Service Vulnerability (Linux) File : nvt/secpod_wireshark_smb_dos_vuln_lin.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
61987 | Wireshark LWRES Dissector dissect_getaddrsbyname_request Remote Overflow Wireshark is prone to an overflow condition. The dissect_getaddrsbyname_request() function fails to properly sanitize user-supplied input resulting in a sta overflow.ck With a specially crafted packet, a context-dependent attacker can potentially cause arbitrary code execution. |
61251 | Diocese of Portsmouth Calendar Extension for TYPO3 Unspecified SQL Injection |
61178 | Wireshark SMB / SMB2 Dissector Remote DoS |
Snort® IPS/IDS
Date | Description |
---|---|
2014-01-10 | Wireshark LWRES Dissector getaddrsbyname buffer overflow attempt RuleID : 17544 - Revision : 9 - Type : SERVER-OTHER |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0360.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100420_wireshark_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
2011-01-21 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-100228.nasl - Type : ACT_GATHER_INFO |
2010-10-11 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_ethereal-6890.nasl - Type : ACT_GATHER_INFO |
2010-07-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-016.nasl - Type : ACT_GATHER_INFO |
2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-3556.nasl - Type : ACT_GATHER_INFO |
2010-06-02 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201006-05.nasl - Type : ACT_GATHER_INFO |
2010-05-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0360.nasl - Type : ACT_GATHER_INFO |
2010-04-22 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0360.nasl - Type : ACT_GATHER_INFO |
2010-03-17 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_ethereal-6889.nasl - Type : ACT_GATHER_INFO |
2010-03-17 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-100301.nasl - Type : ACT_GATHER_INFO |
2010-03-17 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12593.nasl - Type : ACT_GATHER_INFO |
2010-03-17 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_wireshark-100203.nasl - Type : ACT_GATHER_INFO |
2010-03-17 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_wireshark-100203.nasl - Type : ACT_GATHER_INFO |
2010-03-17 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_wireshark-100203.nasl - Type : ACT_GATHER_INFO |
2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1983.nasl - Type : ACT_GATHER_INFO |
2010-02-10 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_bb0a879515dc11dfbf0a002170daae37.nasl - Type : ACT_GATHER_INFO |
2010-02-03 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-031.nasl - Type : ACT_GATHER_INFO |
2010-01-29 | Name : The remote host has an application that is affected by several buffer overflows. File : wireshark_1_2_6.nasl - Type : ACT_GATHER_INFO |
2009-12-27 | Name : The remote Fedora host is missing a security update. File : fedora_2009-13592.nasl - Type : ACT_GATHER_INFO |
2009-12-18 | Name : The remote host has an application that is affected by multiple vulnerabilities File : wireshark_1_2_5.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:29:11 |
|
2013-05-11 00:43:40 |
|