Executive Summary
| Summary | |
|---|---|
| Title | wireshark security update |
| Informations | |||
|---|---|---|---|
| Name | DSA-2395 | First vendor Publication | 2012-01-27 |
| Vendor | Debian | Last vendor Modification | 2012-01-27 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Laurent Butti discovered a buffer underflow in the LANalyzer dissector of the Wireshark network traffic analyzer, which could lead to the execution of arbitrary code (CVE-2012-0068) This update also addresses several bugs, which can lead to crashes of Wireshark. These are not treated as security issues, but are fixed nonetheless if security updates are scheduled: CVE-2011-3483, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066 and CVE-2012-0067. For the stable distribution (squeeze), this problem has been fixed in version 1.2.11-6+squeeze6. For the unstable distribution (sid), this problem has been fixed in version 1.6.5-1. We recommend that you upgrade your wireshark packages. |
Original Source
| Url : http://www.debian.org/security/2012/dsa-2395 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 80 % | CWE-20 | Improper Input Validation |
| 20 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:14642 | |||
| Oval ID: | oval:org.mitre.oval:def:14642 | ||
| Title: | DEPRECATED: Vulnerability in dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
| Description: | The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a capture file, as demonstrated by an airopeek file. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2012-0041 | Version: | 2 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:14971 | |||
| Oval ID: | oval:org.mitre.oval:def:14971 | ||
| Title: | Wireshark 1.6.x before 1.6.2 buffer exception handling vulnerability | ||
| Description: | Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (application crash) via a malformed capture file that leads to an invalid root tvbuff, related to a "buffer exception handling vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2011-3483 | Version: | 6 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:15061 | |||
| Oval ID: | oval:org.mitre.oval:def:15061 | ||
| Title: | DEPRECATED: String conversion vulnerability in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
| Description: | Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet, related to epan/to_str.c. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2012-0042 | Version: | 2 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:15065 | |||
| Oval ID: | oval:org.mitre.oval:def:15065 | ||
| Title: | DSA-2395-1 wireshark -- buffer underflow | ||
| Description: | Laurent Butti discovered a buffer underflow in the LANalyzer dissector of the Wireshark network traffic analyzer, which could lead to the execution of arbitrary code. This update also addresses several bugs, which can lead to crashes of Wireshark. These are not treated as security issues, but are fixed nonetheless if security updates are scheduled: CVE-2011-3483, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066 and CVE-2012-0067. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2395-1 CVE-2011-3483 CVE-2012-0041 CVE-2012-0042 CVE-2012-0066 CVE-2012-0067 CVE-2012-0068 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:15111 | |||
| Oval ID: | oval:org.mitre.oval:def:15111 | ||
| Title: | Long packet handling vulnerability in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
| Description: | Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or (3) NETMON 2 capture file. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2012-0066 | Version: | 5 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:15192 | |||
| Oval ID: | oval:org.mitre.oval:def:15192 | ||
| Title: | Vulnerability in wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
| Description: | wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in an AIX iptrace file. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2012-0067 | Version: | 5 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:15252 | |||
| Oval ID: | oval:org.mitre.oval:def:15252 | ||
| Title: | DEPRECATED: Long packet handling vulnerability in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
| Description: | Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or (3) NETMON 2 capture file. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2012-0066 | Version: | 2 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:15297 | |||
| Oval ID: | oval:org.mitre.oval:def:15297 | ||
| Title: | Vulnerability in dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
| Description: | The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a capture file, as demonstrated by an airopeek file. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2012-0041 | Version: | 5 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:15319 | |||
| Oval ID: | oval:org.mitre.oval:def:15319 | ||
| Title: | DEPRECATED: Vulnerability in lanalyzer_read function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
| Description: | The lanalyzer_read function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a Novell catpure file containing a record that is too small. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2012-0068 | Version: | 2 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:15368 | |||
| Oval ID: | oval:org.mitre.oval:def:15368 | ||
| Title: | String conversion vulnerability in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
| Description: | Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet, related to epan/to_str.c. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2012-0042 | Version: | 5 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:15379 | |||
| Oval ID: | oval:org.mitre.oval:def:15379 | ||
| Title: | Vulnerability in lanalyzer_read function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
| Description: | The lanalyzer_read function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a Novell catpure file containing a record that is too small. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2012-0068 | Version: | 5 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:15489 | |||
| Oval ID: | oval:org.mitre.oval:def:15489 | ||
| Title: | DEPRECATED: Vulnerability in wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
| Description: | wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in an AIX iptrace file. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2012-0067 | Version: | 2 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Wireshark |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-07-30 | Name : CentOS Update for wireshark CESA-2012:0509 centos6 File : nvt/gb_CESA-2012_0509_wireshark_centos6.nasl |
| 2012-07-09 | Name : RedHat Update for wireshark RHSA-2012:0509-01 File : nvt/gb_RHSA-2012_0509-01_wireshark.nasl |
| 2012-05-02 | Name : Wireshark Multiple Denial of Service Vulnerabilities (Mac OS X) File : nvt/gb_wireshark_mult_dos_vuln_macosx_oct11.nasl |
| 2012-04-24 | Name : Wireshark Multiple Vulnerabilities (Mac OS X) File : nvt/gb_wireshark_mult_vuln_macosx.nasl |
| 2012-04-23 | Name : Wireshark Multiple Vulnerabilities - April 12 (Windows) File : nvt/gb_wireshark_mult_vuln_win_apr12.nasl |
| 2012-04-02 | Name : Fedora Update for wireshark FEDORA-2012-0435 File : nvt/gb_fedora_2012_0435_wireshark_fc16.nasl |
| 2012-02-12 | Name : FreeBSD Ports: wireshark File : nvt/freebsd_wireshark6.nasl |
| 2012-02-12 | Name : Gentoo Security Advisory GLSA 201110-02 (wireshark) File : nvt/glsa_201110_02.nasl |
| 2012-02-11 | Name : Debian Security Advisory DSA 2395-1 (wireshark) File : nvt/deb_2395_1.nasl |
| 2012-01-25 | Name : Fedora Update for wireshark FEDORA-2012-0440 File : nvt/gb_fedora_2012_0440_wireshark_fc15.nasl |
| 2011-10-04 | Name : Wireshark Multiple Denial of Service Vulnerabilities (Windows) File : nvt/gb_wireshark_mult_dos_vuln_win_oct11.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 75346 | Wireshark Packet Trace File Handling Remote DoS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_wireshark_20120404.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_wireshark-120201.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_wireshark-111013.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_wireshark-111013.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-123.nasl - Type : ACT_GATHER_INFO |
| 2013-08-29 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201308-05.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-0125.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-0509.nasl - Type : ACT_GATHER_INFO |
| 2013-01-17 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20130108_wireshark_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2013-01-17 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-0125.nasl - Type : ACT_GATHER_INFO |
| 2013-01-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0125.nasl - Type : ACT_GATHER_INFO |
| 2012-09-06 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-138.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120423_wireshark_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2012-04-25 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-0509.nasl - Type : ACT_GATHER_INFO |
| 2012-04-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-0509.nasl - Type : ACT_GATHER_INFO |
| 2012-02-24 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-120131.nasl - Type : ACT_GATHER_INFO |
| 2012-02-24 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_wireshark-7943.nasl - Type : ACT_GATHER_INFO |
| 2012-01-31 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2395.nasl - Type : ACT_GATHER_INFO |
| 2012-01-25 | Name : The remote Fedora host is missing a security update. File : fedora_2012-0440.nasl - Type : ACT_GATHER_INFO |
| 2012-01-24 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_3ebb2dc8460911e19f4700e0815b8da8.nasl - Type : ACT_GATHER_INFO |
| 2012-01-23 | Name : The remote Fedora host is missing a security update. File : fedora_2012-0435.nasl - Type : ACT_GATHER_INFO |
| 2012-01-13 | Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_4_11.nasl - Type : ACT_GATHER_INFO |
| 2012-01-13 | Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_6_5.nasl - Type : ACT_GATHER_INFO |
| 2011-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_wireshark-7796.nasl - Type : ACT_GATHER_INFO |
| 2011-12-13 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-111013.nasl - Type : ACT_GATHER_INFO |
| 2011-10-24 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_wireshark-7795.nasl - Type : ACT_GATHER_INFO |
| 2011-10-10 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201110-02.nasl - Type : ACT_GATHER_INFO |
| 2011-09-12 | Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_6_2.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:30:46 |
|
