Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2009:058 | First vendor Publication | 2009-02-26 |
| Vendor | Mandriva | Last vendor Modification | 2009-02-26 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed NetScreen snoop file. (CVE-2009-0599) Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted Tektronix K12 text capture file, as demonstrated by a file with exactly one frame. (CVE-2009-0600) Format string vulnerability in Wireshark 0.99.8 through 1.0.5 on non-Windows platforms allows local users to cause a denial of service (application crash) via format string specifiers in the HOME environment variable. (CVE-2009-0601) This update provides Wireshark 1.0.6, which is not vulnerable to these issues. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2009:058 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 33 % | CWE-134 | Uncontrolled Format String (CWE/SANS Top 25) |
| 33 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| 33 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10853 | |||
| Oval ID: | oval:org.mitre.oval:def:10853 | ||
| Title: | Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted Tektronix K12 text capture file, as demonstrated by a file with exactly one frame. | ||
| Description: | Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted Tektronix K12 text capture file, as demonstrated by a file with exactly one frame. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-0600 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:14732 | |||
| Oval ID: | oval:org.mitre.oval:def:14732 | ||
| Title: | Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 | ||
| Description: | Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed NetScreen snoop file. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2009-0599 | Version: | 8 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:15041 | |||
| Oval ID: | oval:org.mitre.oval:def:15041 | ||
| Title: | Wireshark 0.99.6 through 1.0.5 vulnerability via crafted Tektronix K12 text capture file | ||
| Description: | Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted Tektronix K12 text capture file, as demonstrated by a file with exactly one frame. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2009-0600 | Version: | 8 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22684 | |||
| Oval ID: | oval:org.mitre.oval:def:22684 | ||
| Title: | ELSA-2009:0313: wireshark security update (Moderate) | ||
| Description: | Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted Tektronix K12 text capture file, as demonstrated by a file with exactly one frame. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2009:0313-01 CVE-2008-4680 CVE-2008-4681 CVE-2008-4682 CVE-2008-4683 CVE-2008-4684 CVE-2008-4685 CVE-2008-5285 CVE-2008-6472 CVE-2009-0599 CVE-2009-0600 | Version: | 45 |
| Platform(s): | Oracle Linux 5 | Product(s): | wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:29088 | |||
| Oval ID: | oval:org.mitre.oval:def:29088 | ||
| Title: | RHSA-2009:0313 -- wireshark security update (Moderate) | ||
| Description: | Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal. Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malformed dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-4683, CVE-2009-0599) | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2009:0313 CESA-2009:0313-CentOS 3 CVE-2008-4680 CVE-2008-4681 CVE-2008-4682 CVE-2008-4683 CVE-2008-4684 CVE-2008-4685 CVE-2008-5285 CVE-2008-6472 CVE-2009-0599 CVE-2009-0600 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 3 | Product(s): | wireshark |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9677 | |||
| Oval ID: | oval:org.mitre.oval:def:9677 | ||
| Title: | Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed NetScreen snoop file. | ||
| Description: | Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed NetScreen snoop file. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-0599 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for wireshark CESA-2009:0313 centos3 i386 File : nvt/gb_CESA-2009_0313_wireshark_centos3_i386.nasl |
| 2011-08-09 | Name : CentOS Update for wireshark CESA-2009:0313 centos4 i386 File : nvt/gb_CESA-2009_0313_wireshark_centos4_i386.nasl |
| 2009-07-06 | Name : Gentoo Security Advisory GLSA 200906-05 (wireshark) File : nvt/glsa_200906_05.nasl |
| 2009-03-31 | Name : wireshark -- multiple vulnerabilities File : nvt/freebsd_ethereal8.nasl |
| 2009-03-20 | Name : Fedora Core 9 FEDORA-2009-1877 (wireshark) File : nvt/fcore_2009_1877.nasl |
| 2009-03-13 | Name : CentOS Security Advisory CESA-2009:0313 (wireshark) File : nvt/ovcesa2009_0313.nasl |
| 2009-03-07 | Name : RedHat Security Advisory RHSA-2009:0313 File : nvt/RHSA_2009_0313.nasl |
| 2009-03-07 | Name : Fedora Core 10 FEDORA-2009-1798 (wireshark) File : nvt/fcore_2009_1798.nasl |
| 2009-03-02 | Name : Mandrake Security Advisory MDVSA-2009:058 (wireshark) File : nvt/mdksa_2009_058.nasl |
| 2009-03-02 | Name : SuSE Security Summary SUSE-SR:2009:005 File : nvt/suse_sr_2009_005.nasl |
| 2009-02-20 | Name : Wireshark Multiple Vulnerabilities Feb 09 (Linux) File : nvt/gb_wireshark_mult_vuln_feb09_lin.nasl |
| 2009-02-20 | Name : Wireshark Multiple Vulnerabilities Feb-09 (Windows) File : nvt/gb_wireshark_mult_vuln_feb09_win.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 52157 | Wireshark HOME Environment Variable Local Format String |
| 51987 | Wireshark Crafted Tektronix K12 Text Capture File Handling DoS |
| 51815 | Wireshark wiretap/netscreen.c NetScreen Snoop Capture File Handling Overflow |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0313.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090304_wireshark_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_wireshark-090218.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_wireshark-090218.nasl - Type : ACT_GATHER_INFO |
| 2009-07-01 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200906-05.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2009-1798.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-058.nasl - Type : ACT_GATHER_INFO |
| 2009-03-23 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_f6f19735924549188a6087948ebb4907.nasl - Type : ACT_GATHER_INFO |
| 2009-03-17 | Name : The remote Fedora host is missing a security update. File : fedora_2009-1877.nasl - Type : ACT_GATHER_INFO |
| 2009-03-05 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-0313.nasl - Type : ACT_GATHER_INFO |
| 2009-03-05 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0313.nasl - Type : ACT_GATHER_INFO |
| 2009-02-23 | Name : The remote openSUSE host is missing a security update. File : suse_wireshark-6007.nasl - Type : ACT_GATHER_INFO |
| 2009-02-10 | Name : The remote host has an application that is susceptible to multiple denial of ... File : wireshark_1_0_6.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:40:04 |
|
