Executive Summary
| Summary | |
|---|---|
| Title | wireshark security and bug fix update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2007:0709 | First vendor Publication | 2007-11-15 |
| Vendor | RedHat | Last vendor Modification | 2007-11-15 |
| Severity (Vendor) | Low | Revision | 02 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.8 | Attack Range | Network |
| Cvss Impact Score | 6.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: New Wireshark packages that fix various security vulnerabilities and functionality bugs are now available for Red Hat Enterprise Linux 4. Wireshark was previously known as Ethereal. This update has been rated as having low security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Wireshark is a program for monitoring network traffic. Several denial of service bugs were found in Wireshark's HTTP, iSeries, DCP ETSI, SSL, MMS, DHCP and BOOTP protocol dissectors. It was possible for Wireshark to crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3393) Wireshark would interpret certain completion codes incorrectly when dissecting IPMI traffic. Additionally, IPMI 2.0 packets would be reported as malformed IPMI traffic. Users of Wireshark should upgrade to these updated packages containing Wireshark version 0.99.6, which correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 245796 - CVE-2007-3389 Wireshark crashes when inspecting HTTP traffic 245797 - CVE-2007-3391 Wireshark loops infinitely when inspecting DCP ETSI traffic 245798 - CVE-2007-3392 Wireshark loops infinitely when inspecting SSL traffic 246221 - CVE-2007-3393 Wireshark corrupts the stack when inspecting BOOTP traffic 246225 - CVE-2007-3390 Wireshark crashes when inspecting iSeries traffic 246229 - CVE-2007-3392 Wireshark crashes when inspecting MMS traffic |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2007-0709.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10663 | |||
| Oval ID: | oval:org.mitre.oval:def:10663 | ||
| Title: | Wireshark before 0.99.6 allows remote attackers to cause a denial of service via malformed (1) SSL or (2) MMS packets that trigger an infinite loop. | ||
| Description: | Wireshark before 0.99.6 allows remote attackers to cause a denial of service via malformed (1) SSL or (2) MMS packets that trigger an infinite loop. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-3392 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:10865 | |||
| Oval ID: | oval:org.mitre.oval:def:10865 | ||
| Title: | Wireshark 0.99.5 and 0.10.x up to 0.10.14, when running on certain systems, allows remote attackers to cause a denial of service (crash) via crafted iSeries capture files that trigger a SIGTRAP. | ||
| Description: | Wireshark 0.99.5 and 0.10.x up to 0.10.14, when running on certain systems, allows remote attackers to cause a denial of service (crash) via crafted iSeries capture files that trigger a SIGTRAP. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-3390 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:11010 | |||
| Oval ID: | oval:org.mitre.oval:def:11010 | ||
| Title: | Off-by-one error in the DHCP/BOOTP dissector in Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via crafted DHCP-over-DOCSIS packets. | ||
| Description: | Off-by-one error in the DHCP/BOOTP dissector in Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via crafted DHCP-over-DOCSIS packets. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-3393 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:11672 | |||
| Oval ID: | oval:org.mitre.oval:def:11672 | ||
| Title: | Wireshark 0.99.5 allows remote attackers to cause a denial of service (memory consumption) via a malformed DCP ETSI packet that triggers an infinite loop. | ||
| Description: | Wireshark 0.99.5 allows remote attackers to cause a denial of service (memory consumption) via a malformed DCP ETSI packet that triggers an infinite loop. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-3391 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:14911 | |||
| Oval ID: | oval:org.mitre.oval:def:14911 | ||
| Title: | DCP ETSI dissector vulnerability in Wireshark 0.99.5 | ||
| Description: | Wireshark 0.99.5 allows remote attackers to cause a denial of service (memory consumption) via a malformed DCP ETSI packet that triggers an infinite loop. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2007-3391 | Version: | 6 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:18616 | |||
| Oval ID: | oval:org.mitre.oval:def:18616 | ||
| Title: | DSA-1322-1 wireshark | ||
| Description: | Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to denial of service. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1322-1 CVE-2007-3390 CVE-2007-3392 CVE-2007-3393 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:21733 | |||
| Oval ID: | oval:org.mitre.oval:def:21733 | ||
| Title: | ELSA-2007:0710: wireshark security update (Low) | ||
| Description: | Off-by-one error in the DHCP/BOOTP dissector in Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via crafted DHCP-over-DOCSIS packets. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2007:0710-04 CVE-2007-3389 CVE-2007-3390 CVE-2007-3391 CVE-2007-3392 CVE-2007-3393 | Version: | 25 |
| Platform(s): | Oracle Linux 5 | Product(s): | wireshark |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:9964 | |||
| Oval ID: | oval:org.mitre.oval:def:9964 | ||
| Title: | Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via a crafted chunked encoding in an HTTP response, possibly related to a zero-length payload. | ||
| Description: | Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via a crafted chunked encoding in an HTTP response, possibly related to a zero-length payload. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-3389 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for ethereal File : nvt/sles9p5009131.nasl |
| 2009-04-09 | Name : Mandriva Update for wireshark MDKSA-2007:145 (wireshark) File : nvt/gb_mandriva_MDKSA_2007_145.nasl |
| 2009-03-06 | Name : RedHat Update for wireshark RHSA-2008:0059-01 File : nvt/gb_RHSA-2008_0059-01_wireshark.nasl |
| 2009-02-27 | Name : CentOS Update for libsmi CESA-2008:0059 centos3 i386 File : nvt/gb_CESA-2008_0059_libsmi_centos3_i386.nasl |
| 2009-02-27 | Name : CentOS Update for libsmi CESA-2008:0059 centos3 x86_64 File : nvt/gb_CESA-2008_0059_libsmi_centos3_x86_64.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200708-12 (wireshark) File : nvt/glsa_200708_12.nasl |
| 2008-09-04 | Name : wireshark -- Multiple problems File : nvt/freebsd_wireshark.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1322-1 (wireshark) File : nvt/deb_1322_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 37643 | Wireshark HTTP Response Crafted Chunked Encoding Remote DoS Wireshark contains a flaw that may allow a remote denial of service. The issue is triggered when a specially crafted HTTP response is received, and will result in loss of availability for the application. |
| 37642 | Wireshark Crafted iSeries Capture File Handling Remote DoS Wireshark contains a flaw that may allow a remote denial of service. The issue is triggered by multiple specially crafted iSeries capture files, and will result in loss of availability for the application. |
| 37641 | Wireshark Malformed DCP ETSI Packet Remote Memory Consumption DoS Wireshark contains a flaw that may allow a remote denial of service. The issue is triggered when the application receives a specially crafted DCP ETSI packet, and will result in loss of availability for the host. |
| 37640 | Wireshark Malformed SSL / MMS Packet Handling DoS Wireshark contains a flaw in the way it handles SSL and MMS packets that may allow a remote denial of service. The issue is triggered by a specially crafted packet, and will result in loss of availability for the application. |
| 37639 | Wireshark DHCP/BOOTP Dissector Crafted DHCP-over-DOCSIS Packet Remote DoS The Wireshark DHCP/BOOTP dissector contains an off-by-one flaw that may allow a remote denial of service. The issue is triggered when multiple DHCP-over-DOCSIS packets are received, and will result in loss of availability for the application. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0059.nasl - Type : ACT_GATHER_INFO |
| 2013-06-29 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0709.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080121_wireshark_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071115_wireshark_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071107_wireshark_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_11574.nasl - Type : ACT_GATHER_INFO |
| 2008-01-22 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0059.nasl - Type : ACT_GATHER_INFO |
| 2008-01-21 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0059.nasl - Type : ACT_GATHER_INFO |
| 2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_ethereal-3888.nasl - Type : ACT_GATHER_INFO |
| 2007-11-16 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0709.nasl - Type : ACT_GATHER_INFO |
| 2007-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0710.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_ethereal-3885.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_wireshark-3886.nasl - Type : ACT_GATHER_INFO |
| 2007-08-21 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200708-12.nasl - Type : ACT_GATHER_INFO |
| 2007-07-11 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-145.nasl - Type : ACT_GATHER_INFO |
| 2007-07-10 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_7fadc0492ba011dc93770016179b2dd5.nasl - Type : ACT_GATHER_INFO |
| 2007-06-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1322.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:50:53 |
|
