Executive Summary
Summary | |
---|---|
Title | wireshark security update |
Informations | |||
---|---|---|---|
Name | DSA-2201 | First vendor Publication | 2011-03-23 |
Vendor | Debian | Last vendor Modification | 2011-03-23 |
Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 6.8 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Huzaifa Sidhpurwala, Joernchen, and Xiaopeng Zhang discovered several vulnerabilities in the Wireshark network traffic analyzer. Vulnerabilities in the DCT3, LDAP and SMB dissectors and in the code to parse pcag-ng files could lead to denial of service or the execution of arbitrary code. For the oldstable distribution (lenny), this problem has been fixed in version 1.0.2-3+lenny13. For the stable distribution (squeeze), this problem has been fixed in version 1.2.11-6+squeeze1 For the unstable distribution (sid), this problem has been fixed in version 1.4.4-1. We recommend that you upgrade your wireshark packages. |
Original Source
Url : http://www.debian.org/security/2011/dsa-2201 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
60 % | CWE-399 | Resource Management Errors |
40 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:14605 | |||
Oval ID: | oval:org.mitre.oval:def:14605 | ||
Title: | Vulnerability in pcap-ng processing in Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 | ||
Description: | Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer during processing of a .pcap file in the pcap-ng format, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed file. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2011-0538 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:14715 | |||
Oval ID: | oval:org.mitre.oval:def:14715 | ||
Title: | Multiple stack consumption vulnerabilities in the dissect_ms_compressed_string and dissect_mscldap_string functions in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 | ||
Description: | Multiple stack consumption vulnerabilities in the dissect_ms_compressed_string and dissect_mscldap_string functions in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 allow remote attackers to cause a denial of service (infinite recursion) via a crafted (1) SMB or (2) Connection-less LDAP (CLDAP) packet. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2011-1140 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:14766 | |||
Oval ID: | oval:org.mitre.oval:def:14766 | ||
Title: | Heap-based buffer overflow in wiretap/dct3trace.c in Wireshark 1.2.0 through 1.2.14 and 1.4.0 through 1.4.3 | ||
Description: | Heap-based buffer overflow in wiretap/dct3trace.c in Wireshark 1.2.0 through 1.2.14 and 1.4.0 through 1.4.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long record in a Nokia DCT3 trace file. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2011-0713 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:14974 | |||
Oval ID: | oval:org.mitre.oval:def:14974 | ||
Title: | Vulnerability in epan/dissectors/packet-ldap.c in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 | ||
Description: | epan/dissectors/packet-ldap.c in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 allows remote attackers to cause a denial of service (memory consumption) via (1) a long LDAP filter string or (2) an LDAP filter string containing many elements. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2011-1141 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:14997 | |||
Oval ID: | oval:org.mitre.oval:def:14997 | ||
Title: | Vulnerability in wiretap/pcapng.c in Wireshark 1.2.0 through 1.2.14 and 1.4.0 through 1.4.3 | ||
Description: | wiretap/pcapng.c in Wireshark 1.2.0 through 1.2.14 and 1.4.0 through 1.4.3 allows remote attackers to cause a denial of service (application crash) via a pcap-ng file that contains a large packet-length field. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2011-1139 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:18399 | |||
Oval ID: | oval:org.mitre.oval:def:18399 | ||
Title: | DSA-2201-1 wireshark - several | ||
Description: | Huzaifa Sidhpurwala, Joernchen, and Xiaopeng Zhang discovered several vulnerabilities in the Wireshark network traffic analyzer. Vulnerabilities in the DCT3, LDAP and SMB dissectors and in the code to parse pcag-ng files could lead to denial of service or the execution of arbitrary code. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2201-1 CVE-2011-0538 CVE-2011-0713 CVE-2011-1139 CVE-2011-1140 CVE-2011-1141 | Version: | 7 |
Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | wireshark |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:21869 | |||
Oval ID: | oval:org.mitre.oval:def:21869 | ||
Title: | RHSA-2011:0369: wireshark security update (Moderate) | ||
Description: | epan/dissectors/packet-ldap.c in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 allows remote attackers to cause a denial of service (memory consumption) via (1) a long LDAP filter string or (2) an LDAP filter string containing many elements. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2011:0369-01 CVE-2011-0444 CVE-2011-0538 CVE-2011-0713 CVE-2011-1139 CVE-2011-1140 CVE-2011-1141 | Version: | 81 |
Platform(s): | Red Hat Enterprise Linux 6 | Product(s): | wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:22896 | |||
Oval ID: | oval:org.mitre.oval:def:22896 | ||
Title: | ELSA-2011:0369: wireshark security update (Moderate) | ||
Description: | epan/dissectors/packet-ldap.c in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 allows remote attackers to cause a denial of service (memory consumption) via (1) a long LDAP filter string or (2) an LDAP filter string containing many elements. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011:0369-01 CVE-2011-0444 CVE-2011-0538 CVE-2011-0713 CVE-2011-1139 CVE-2011-1140 CVE-2011-1141 | Version: | 29 |
Platform(s): | Oracle Linux 6 | Product(s): | wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27893 | |||
Oval ID: | oval:org.mitre.oval:def:27893 | ||
Title: | DEPRECATED: ELSA-2011-0369 -- wireshark security update (moderate) | ||
Description: | [1.2.15-1.0.1.el6_0.1] - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect [1.2.15-1] - upgrade to 1.2.15 - see http://www.wireshark.org/docs/relnotes/wireshark-1.2.14.html - see http://www.wireshark.org/docs/relnotes/wireshark-1.2.15.html - Resolves: CVE-2011-0444 CVE-2011-0538 CVE-2011-0713 CVE-2011-1139 CVE-2011-1140 CVE-2011-1141 CVE-2011-1143 | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011-0369 CVE-2011-0444 CVE-2011-0538 CVE-2011-0713 CVE-2011-1139 CVE-2011-1140 CVE-2011-1141 | Version: | 4 |
Platform(s): | Oracle Linux 6 | Product(s): | wireshark |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-07-30 | Name : CentOS Update for wireshark CESA-2011:0370 centos5 x86_64 File : nvt/gb_CESA-2011_0370_wireshark_centos5_x86_64.nasl |
2012-06-27 | Name : Wireshark Multiple Vulnerabilities March-11 (Mac OS X) File : nvt/gb_wireshark_mult_vuln_mar11_macosx.nasl |
2012-06-27 | Name : Wireshark Multiple Vulnerabilities-01 March 11 (Mac OS X) File : nvt/gb_wireshark_mult_vuln01_mar11_macosx.nasl |
2012-06-06 | Name : RedHat Update for wireshark RHSA-2011:0369-01 File : nvt/gb_RHSA-2011_0369-01_wireshark.nasl |
2012-04-25 | Name : Wireshark Denial of Service Vulnerability (Mac OS X) File : nvt/secpod_wireshark_dos_vuln_macosx.nasl |
2012-02-12 | Name : Gentoo Security Advisory GLSA 201110-02 (wireshark) File : nvt/glsa_201110_02.nasl |
2011-08-09 | Name : CentOS Update for wireshark CESA-2011:0370 centos5 i386 File : nvt/gb_CESA-2011_0370_wireshark_centos5_i386.nasl |
2011-05-12 | Name : Debian Security Advisory DSA 2201-1 (wireshark) File : nvt/deb_2201_1.nasl |
2011-03-25 | Name : CentOS Update for wireshark CESA-2011:0370 centos4 i386 File : nvt/gb_CESA-2011_0370_wireshark_centos4_i386.nasl |
2011-03-24 | Name : RedHat Update for wireshark RHSA-2011:0370-01 File : nvt/gb_RHSA-2011_0370-01_wireshark.nasl |
2011-03-15 | Name : Mandriva Update for wireshark MDVSA-2011:044 (wireshark) File : nvt/gb_mandriva_MDVSA_2011_044.nasl |
2011-03-15 | Name : Fedora Update for wireshark FEDORA-2011-2632 File : nvt/gb_fedora_2011_2632_wireshark_fc14.nasl |
2011-03-15 | Name : Fedora Update for wireshark FEDORA-2011-2620 File : nvt/gb_fedora_2011_2620_wireshark_fc13.nasl |
2011-03-09 | Name : Wireshark Multiple Vulnerabilities - March-11 (Windows) File : nvt/gb_wireshark_mult_vuln_mar11_win.nasl |
2011-03-09 | Name : Wireshark Multiple Vulnerabilities March-11 (Windows) File : nvt/gb_wireshark_mult_vuln_mar11_win01.nasl |
2011-02-15 | Name : Wireshark Denial of Service Vulnerability (Linux) File : nvt/gb_wireshark_dos_vuln_lin.nasl |
2011-02-15 | Name : Wireshark Denial of Service Vulnerability (Windows) File : nvt/gb_wireshark_dos_vuln_win.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
71556 | Wireshark pcap-ng File Handling Memory Corruption A memory corruption flaw exists in Wireshark. The program frees an uninitialized pointer when processing .pcap files, resulting in memory corruption. With a specially crafted .pcap file, a context-dependent attacker can execute arbitrary code. |
71555 | Wireshark pcap-ng Large packet-length Field DoS Wireshark contains a flaw that may allow a remote denial of service. The issue is triggered when the wiretap/pcapng.c process fails to properly sanitize user-supplied input when handling pcap-ng files containing large packet-length fields, allowing a remote attacker to cause a denial of service. |
71554 | Wireshark Nokia DCT3 Trace File Handling Overflow Wireshark is prone to an overflow condition. The wiretap/dct3trace.c process fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted long record in a Nokia DCT3 trace file, a context-dependent attacker can potentially execute arbitrary code. |
71553 | Wireshark Multiple Function SMB Packet Handling DoS Wireshark contains a flaw that may allow a remote of service. The issue is triggered when an attacker directs an infinite recursive function call to the 'dissect_ms_compressed_string' and 'dissect_mscldap_string' functions via a a crafted SMB packet, resulting in a loss of availability. |
71552 | Wireshark Multiple Function CLDAP Packet Handling DoS Wireshark contains a flaw that may allow a remote of service. The issue is triggered when an attacker directs an infinite recursive function call to the 'dissect_ms_compressed_string' and 'dissect_mscldap_string' functions via a a crafted SMB orConnection-less LDAP (CLDAP) packet, resulting in a loss of availability. |
71550 | Wireshark LDAP Dissector Filter String Memory Consumption DoS Wireshark contains a flaw that may allow a remote denial of service. The issue is triggered when 'epan/dissectors/packet-ldap.c' (LDAP Dissector) fails to properly process filter strings, allowing an attacker to use a crafted filter string to cause a denial of service via memory consumption. |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_wireshark-110411.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_wireshark-110411.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-0370.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-0369.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110321_wireshark_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
2011-10-10 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201110-02.nasl - Type : ACT_GATHER_INFO |
2011-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_wireshark-110411.nasl - Type : ACT_GATHER_INFO |
2011-04-07 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-110331.nasl - Type : ACT_GATHER_INFO |
2011-03-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2201.nasl - Type : ACT_GATHER_INFO |
2011-03-23 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2011-0370.nasl - Type : ACT_GATHER_INFO |
2011-03-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-0369.nasl - Type : ACT_GATHER_INFO |
2011-03-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-0370.nasl - Type : ACT_GATHER_INFO |
2011-03-14 | Name : The remote Fedora host is missing a security update. File : fedora_2011-2632.nasl - Type : ACT_GATHER_INFO |
2011-03-14 | Name : The remote Fedora host is missing a security update. File : fedora_2011-2620.nasl - Type : ACT_GATHER_INFO |
2011-03-09 | Name : The remote Fedora host is missing a security update. File : fedora_2011-2648.nasl - Type : ACT_GATHER_INFO |
2011-03-09 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-044.nasl - Type : ACT_GATHER_INFO |
2011-03-02 | Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_4_4.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:30:01 |
|