Executive Summary
Summary | |
---|---|
Title | wireshark security, bug fix, and enhancement update |
Informations | |||
---|---|---|---|
Name | RHSA-2013:0125 | First vendor Publication | 2013-01-08 |
Vendor | RedHat | Last vendor Modification | 2013-01-08 |
Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P) | |||
---|---|---|---|
Cvss Base Score | 4.3 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated wireshark packages that fix several security issues, three bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. Description: Wireshark, previously known as Ethereal, is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network. A heap-based buffer overflow flaw was found in the way Wireshark handled Endace ERF (Extensible Record Format) capture files. If Wireshark opened a specially-crafted ERF capture file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2011-4102) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0066, CVE-2012-0067, CVE-2012-4285, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291) The CVE-2011-1958, CVE-2011-1959, CVE-2011-2175, and CVE-2011-4102 issues were discovered by Huzaifa Sidhpurwala of the Red Hat Security Response Team. This update also fixes the following bugs: * When Wireshark starts with the X11 protocol being tunneled through an SSH connection, it automatically prepares its capture filter to omit the SSH packets. If the SSH connection was to a link-local IPv6 address including an interface name (for example ssh -X [ipv6addr]%eth0), Wireshark parsed this address erroneously, constructed an incorrect capture filter and refused to capture packets. The "Invalid capture filter" message was displayed. With this update, parsing of link-local IPv6 addresses is fixed and Wireshark correctly prepares a capture filter to omit SSH packets over a link-local IPv6 connection. (BZ#438473) * Previously, Wireshark's column editing dialog malformed column names when they were selected. With this update, the dialog is fixed and no longer breaks column names. (BZ#493693) * Previously, TShark, the console packet analyzer, did not properly analyze the exit code of Dumpcap, Wireshark's packet capturing back end. As a result, TShark returned exit code 0 when Dumpcap failed to parse its command-line arguments. In this update, TShark correctly propagates the Dumpcap exit code and returns a non-zero exit code when Dumpcap fails. (BZ#580510) * Previously, the TShark "-s" (snapshot length) option worked only for a value greater than 68 bytes. If a lower value was specified, TShark captured just 68 bytes of incoming packets. With this update, the "-s" option is fixed and sizes lower than 68 bytes work as expected. (BZ#580513) This update also adds the following enhancement: * In this update, support for the "NetDump" protocol was added. (BZ#484999) All users of Wireshark are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. All running instances of Wireshark must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 438473 - wireshark via ssh -X on ipv6 link-local address fails to allow capture 484999 - add netdump dissector to wireshark 580510 - tshark returns exit code 0 in case of errors 580513 - tshark snaplen parameter does not work 710039 - CVE-2011-1959 wireshark: Stack-based buffer over-read from tvbuff buffer when reading snoop capture files 710109 - CVE-2011-2175 wireshark: Heap-based buffer over-read in Visual Networks dissector 710184 - CVE-2011-1958 wireshark (64bit): NULL pointer dereference by processing of a corrupted Diameter dictionary file 723215 - CVE-2011-2698 wireshark: Infinite loop in the ANSI A Interface (IS-634/IOS) dissector 750648 - CVE-2011-4102 wireshark: buffer overflow in the ERF file reader 773726 - CVE-2012-0041 wireshark: multiple file parser vulnerabilities (wnpa-sec-2012-01) 773728 - CVE-2012-0042 wireshark: NULL pointer vulnerabilities (wnpa-sec-2012-02) 783360 - CVE-2012-0066 Wireshark: Dos via large buffer allocation request 783363 - CVE-2012-0067 Wireshark: Dos due to integer overflow in IPTrace capture format parser 848541 - CVE-2012-4285 wireshark: crash due to zero division in DCP ETSI dissector (wnpa-sec-2012-13) 848561 - CVE-2012-4289 wireshark: DoS via excessive CPU consumption in AFP dissector (wnpa-sec-2012-17) 848572 - CVE-2012-4291 wireshark: DoS via excessive system resource consumption in CIP dissector (wnpa-sec-2012-20) 848578 - CVE-2012-4290 wireshark: DoS via excessive CPU consumption in CTDB dissector (wnpa-sec-2012-23) |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2013-0125.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
27 % | CWE-399 | Resource Management Errors |
27 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
27 % | CWE-20 | Improper Input Validation |
18 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:12075 | |||
Oval ID: | oval:org.mitre.oval:def:12075 | ||
Title: | DSA-2274-1 wireshark -- several | ||
Description: | Huzaifa Sidhpurwala, David Maciejak and others discovered several vulnerabilities in the X.509if and DICOM dissectors and in the code to process various capture and dictionary files, which could lead to denial of service or the execution of arbitrary code. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2274-1 CVE-2011-1590 CVE-2011-1957 CVE-2011-1958 CVE-2011-1959 CVE-2011-2174 CVE-2011-2175 | Version: | 5 |
Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | wireshark |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:14610 | |||
Oval ID: | oval:org.mitre.oval:def:14610 | ||
Title: | ANSI MAP dissector vulnerability in Wireshark 1.4.x before 1.4.8 and 1.6.x before 1.6.1 | ||
Description: | Off-by-one error in the elem_cell_id_aux function in epan/dissectors/packet-ansi_a.c in the ANSI MAP dissector in Wireshark 1.4.x before 1.4.8 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (infinite loop) via an invalid packet. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2011-2698 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:14642 | |||
Oval ID: | oval:org.mitre.oval:def:14642 | ||
Title: | DEPRECATED: Vulnerability in dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
Description: | The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a capture file, as demonstrated by an airopeek file. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-0041 | Version: | 2 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:14645 | |||
Oval ID: | oval:org.mitre.oval:def:14645 | ||
Title: | Integer underflow in the visual_read function in wiretap/visual.c vulnerability in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 | ||
Description: | Integer underflow in the visual_read function in wiretap/visual.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a malformed Visual Networks file that triggers a heap-based buffer over-read. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2011-2175 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:14656 | |||
Oval ID: | oval:org.mitre.oval:def:14656 | ||
Title: | Vulnerability in the snoop_read function in wiretap/snoop.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 | ||
Description: | The snoop_read function in wiretap/snoop.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 does not properly handle certain virtualizable buffers, which allows remote attackers to cause a denial of service (application crash) via a large length value in a snoop file that triggers a stack-based buffer over-read. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2011-1959 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:14963 | |||
Oval ID: | oval:org.mitre.oval:def:14963 | ||
Title: | epan/dissectors/packet-afp.c in the AFP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (loop and CPU consumption) via a large number of ACL entries | ||
Description: | epan/dissectors/packet-afp.c in the AFP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (loop and CPU consumption) via a large number of ACL entries. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-4289 | Version: | 5 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15045 | |||
Oval ID: | oval:org.mitre.oval:def:15045 | ||
Title: | Diameter dictionary file vulnerability in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 | ||
Description: | Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Diameter dictionary file. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2011-1958 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15061 | |||
Oval ID: | oval:org.mitre.oval:def:15061 | ||
Title: | DEPRECATED: String conversion vulnerability in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
Description: | Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet, related to epan/to_str.c. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-0042 | Version: | 2 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15073 | |||
Oval ID: | oval:org.mitre.oval:def:15073 | ||
Title: | Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file parser in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 | ||
Description: | Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file parser in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (application crash) via a malformed file. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2011-4102 | Version: | 6 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15088 | |||
Oval ID: | oval:org.mitre.oval:def:15088 | ||
Title: | DSA-2351-1 wireshark -- buffer overflow | ||
Description: | Huzaifa Sidhpurwala discovered a buffer overflow in Wireshark's ERF dissector, which could lead to the execution of arbitrary code. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2351-1 CVE-2011-4102 | Version: | 5 |
Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | wireshark |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:15111 | |||
Oval ID: | oval:org.mitre.oval:def:15111 | ||
Title: | Long packet handling vulnerability in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
Description: | Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or (3) NETMON 2 capture file. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-0066 | Version: | 5 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15192 | |||
Oval ID: | oval:org.mitre.oval:def:15192 | ||
Title: | Vulnerability in wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
Description: | wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in an AIX iptrace file. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-0067 | Version: | 5 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15252 | |||
Oval ID: | oval:org.mitre.oval:def:15252 | ||
Title: | DEPRECATED: Long packet handling vulnerability in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
Description: | Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or (3) NETMON 2 capture file. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-0066 | Version: | 2 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15297 | |||
Oval ID: | oval:org.mitre.oval:def:15297 | ||
Title: | Vulnerability in dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
Description: | The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a capture file, as demonstrated by an airopeek file. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-0041 | Version: | 5 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15368 | |||
Oval ID: | oval:org.mitre.oval:def:15368 | ||
Title: | String conversion vulnerability in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
Description: | Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet, related to epan/to_str.c. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-0042 | Version: | 5 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15489 | |||
Oval ID: | oval:org.mitre.oval:def:15489 | ||
Title: | DEPRECATED: Vulnerability in wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 | ||
Description: | wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in an AIX iptrace file. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-0067 | Version: | 2 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15619 | |||
Oval ID: | oval:org.mitre.oval:def:15619 | ||
Title: | The CTDB dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (loop and CPU consumption) via a malformed packet | ||
Description: | The CTDB dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (loop and CPU consumption) via a malformed packet. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-4290 | Version: | 5 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15712 | |||
Oval ID: | oval:org.mitre.oval:def:15712 | ||
Title: | The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a zero-length message | ||
Description: | The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a zero-length message. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-4285 | Version: | 5 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15813 | |||
Oval ID: | oval:org.mitre.oval:def:15813 | ||
Title: | The CIP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet | ||
Description: | The CIP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-4291 | Version: | 5 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012 | Product(s): | Wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:20890 | |||
Oval ID: | oval:org.mitre.oval:def:20890 | ||
Title: | RHSA-2013:0125: wireshark security, bug fix, and enhancement update (Moderate) | ||
Description: | The CIP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2013:0125-00 CESA-2013:0125 CVE-2011-1958 CVE-2011-1959 CVE-2011-2175 CVE-2011-2698 CVE-2011-4102 CVE-2012-0041 CVE-2012-0042 CVE-2012-0066 CVE-2012-0067 CVE-2012-4285 CVE-2012-4289 CVE-2012-4290 CVE-2012-4291 | Version: | 185 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | wireshark |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:23298 | |||
Oval ID: | oval:org.mitre.oval:def:23298 | ||
Title: | ELSA-2013:0125: wireshark security, bug fix, and enhancement update (Moderate) | ||
Description: | The CIP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2013:0125-00 CVE-2011-1958 CVE-2011-1959 CVE-2011-2175 CVE-2011-2698 CVE-2011-4102 CVE-2012-0041 CVE-2012-0042 CVE-2012-0066 CVE-2012-0067 CVE-2012-4285 CVE-2012-4289 CVE-2012-4290 CVE-2012-4291 | Version: | 57 |
Platform(s): | Oracle Linux 5 | Product(s): | wireshark |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27311 | |||
Oval ID: | oval:org.mitre.oval:def:27311 | ||
Title: | DEPRECATED: ELSA-2013-0125 -- wireshark security, bug fix, and enhancement update (moderate) | ||
Description: | [1.0.15-5.0.1.el5] - Added oracle-ocfs2-network.patch - increase max packet size to 65536 (Herbert van den Bergh) [orabug 13542633] [1.0.15-5] - fixed CVE-2012-4285, CVE-2012-4289, CVE-2012-4291 and CVE-2012-4290 (#849521) | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2013-0125 CVE-2011-1958 CVE-2011-1959 CVE-2011-2175 CVE-2011-2698 CVE-2011-4102 CVE-2012-0041 CVE-2012-0042 CVE-2012-0066 CVE-2012-0067 CVE-2012-4285 CVE-2012-4289 CVE-2012-4290 CVE-2012-4291 | Version: | 4 |
Platform(s): | Oracle Linux 5 | Product(s): | wireshark |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-12-28 | Name : Wireshark Multiple Vulnerabilities-01 Dec 2012 (Mac OS X) File : nvt/gb_wireshark_mult_vuln01_dec12_macosx.nasl |
2012-08-30 | Name : FreeBSD Ports: wireshark File : nvt/freebsd_wireshark7.nasl |
2012-08-30 | Name : Fedora Update for wireshark FEDORA-2012-12091 File : nvt/gb_fedora_2012_12091_wireshark_fc17.nasl |
2012-08-30 | Name : Fedora Update for wireshark FEDORA-2012-12085 File : nvt/gb_fedora_2012_12085_wireshark_fc16.nasl |
2012-08-21 | Name : Wireshark Multiple Vulnerabilities - August 2012 (Windows) File : nvt/gb_wireshark_mult_vuln_aug12_win.nasl |
2012-08-17 | Name : Mandriva Update for wireshark MDVSA-2012:134 (wireshark) File : nvt/gb_mandriva_MDVSA_2012_134.nasl |
2012-07-30 | Name : CentOS Update for wireshark CESA-2012:0509 centos6 File : nvt/gb_CESA-2012_0509_wireshark_centos6.nasl |
2012-07-09 | Name : RedHat Update for wireshark RHSA-2012:0509-01 File : nvt/gb_RHSA-2012_0509-01_wireshark.nasl |
2012-06-29 | Name : Wireshark Multiple Denial of Service Vulnerabilities June-11 (Mac OS X) File : nvt/secpod_wireshark_mult_dos_vuln_jun11_macosx.nasl |
2012-05-02 | Name : Wireshark ANSI A MAP Files Denial of Service Vulnerability (Mac OS X) File : nvt/gb_wireshark_ansi_map_dos_vuln_macosx.nasl |
2012-05-02 | Name : Wireshark Heap Based BOF and Denial of Service Vulnerabilities (Mac OS X) File : nvt/gb_wireshark_bof_n_dos_vuln_macosx.nasl |
2012-04-24 | Name : Wireshark Multiple Vulnerabilities (Mac OS X) File : nvt/gb_wireshark_mult_vuln_macosx.nasl |
2012-04-23 | Name : Wireshark Multiple Vulnerabilities - April 12 (Windows) File : nvt/gb_wireshark_mult_vuln_win_apr12.nasl |
2012-04-02 | Name : Fedora Update for wireshark FEDORA-2012-0435 File : nvt/gb_fedora_2012_0435_wireshark_fc16.nasl |
2012-02-13 | Name : Debian Security Advisory DSA 2351-1 (wireshark) File : nvt/deb_2351_1.nasl |
2012-02-12 | Name : Gentoo Security Advisory GLSA 201110-02 (wireshark) File : nvt/glsa_201110_02.nasl |
2012-02-12 | Name : FreeBSD Ports: wireshark File : nvt/freebsd_wireshark6.nasl |
2012-02-11 | Name : Debian Security Advisory DSA 2395-1 (wireshark) File : nvt/deb_2395_1.nasl |
2012-01-25 | Name : Fedora Update for wireshark FEDORA-2012-0440 File : nvt/gb_fedora_2012_0440_wireshark_fc15.nasl |
2011-11-08 | Name : Wireshark Heap Based BOF and Denial of Service Vulnerabilities (Windows) File : nvt/gb_wireshark_bof_n_dos_vuln_win.nasl |
2011-08-26 | Name : Wireshark ANSI A MAP Files Denial of Service Vulnerability (Win) File : nvt/secpod_wireshark_ansi_map_dos_vuln_win.nasl |
2011-08-12 | Name : Fedora Update for wireshark FEDORA-2011-9638 File : nvt/gb_fedora_2011_9638_wireshark_fc15.nasl |
2011-08-12 | Name : Fedora Update for wireshark FEDORA-2011-9640 File : nvt/gb_fedora_2011_9640_wireshark_fc14.nasl |
2011-08-03 | Name : Debian Security Advisory DSA 2274-1 (wireshark) File : nvt/deb_2274_1.nasl |
2011-07-12 | Name : Fedora Update for wireshark FEDORA-2011-7821 File : nvt/gb_fedora_2011_7821_wireshark_fc15.nasl |
2011-06-20 | Name : Fedora Update for wireshark FEDORA-2011-7846 File : nvt/gb_fedora_2011_7846_wireshark_fc14.nasl |
2011-06-20 | Name : Fedora Update for wireshark FEDORA-2011-7858 File : nvt/gb_fedora_2011_7858_wireshark_fc13.nasl |
2011-06-13 | Name : Wireshark Multiple Denial of Service Vulnerabilities (Windows) File : nvt/gb_wireshark_mult_dos_vuln_win_jun11.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
76770 | Wireshark ERF File Parser Remote Overflow |
74731 | Wireshark ANSI MAP Dissector epan/dissectors/packet-ansi_a.c elem_cell_id_aux... |
72979 | Wireshark wiretap/visual.c visual_read Function Visual Networks File Handling... |
72977 | Wireshark wiretap/snoop.c snoop_read Function Virtualizable Buffer Handling R... |
72976 | Wireshark Diameter Dictionary File Handling Remote DoS |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_wireshark_20121120.nasl - Type : ACT_GATHER_INFO |
2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_wireshark_20120404.nasl - Type : ACT_GATHER_INFO |
2014-11-12 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-1569.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_wireshark-120201.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_wireshark-111013.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_wireshark-111013.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-540.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-526.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-123.nasl - Type : ACT_GATHER_INFO |
2013-12-10 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20131121_wireshark_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2013-12-10 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2013-251.nasl - Type : ACT_GATHER_INFO |
2013-11-27 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-1569.nasl - Type : ACT_GATHER_INFO |
2013-11-21 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-1569.nasl - Type : ACT_GATHER_INFO |
2013-08-29 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201308-05.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-0125.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-0509.nasl - Type : ACT_GATHER_INFO |
2013-04-20 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-055.nasl - Type : ACT_GATHER_INFO |
2013-01-25 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-120831.nasl - Type : ACT_GATHER_INFO |
2013-01-17 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-0125.nasl - Type : ACT_GATHER_INFO |
2013-01-17 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20130108_wireshark_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2013-01-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0125.nasl - Type : ACT_GATHER_INFO |
2012-09-14 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_wireshark-8267.nasl - Type : ACT_GATHER_INFO |
2012-09-06 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-164.nasl - Type : ACT_GATHER_INFO |
2012-09-06 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2012-134.nasl - Type : ACT_GATHER_INFO |
2012-08-28 | Name : The remote Fedora host is missing a security update. File : fedora_2012-12085.nasl - Type : ACT_GATHER_INFO |
2012-08-28 | Name : The remote Fedora host is missing a security update. File : fedora_2012-12091.nasl - Type : ACT_GATHER_INFO |
2012-08-20 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_4cdfe875e8d611e1bea0002354ed89bc.nasl - Type : ACT_GATHER_INFO |
2012-08-17 | Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_8_2.nasl - Type : ACT_GATHER_INFO |
2012-08-17 | Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_6_10.nasl - Type : ACT_GATHER_INFO |
2012-08-17 | Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_4_15.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120423_wireshark_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2012-04-25 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-0509.nasl - Type : ACT_GATHER_INFO |
2012-04-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-0509.nasl - Type : ACT_GATHER_INFO |
2012-02-24 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-120131.nasl - Type : ACT_GATHER_INFO |
2012-02-24 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_wireshark-7943.nasl - Type : ACT_GATHER_INFO |
2012-01-31 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2395.nasl - Type : ACT_GATHER_INFO |
2012-01-25 | Name : The remote Fedora host is missing a security update. File : fedora_2012-0440.nasl - Type : ACT_GATHER_INFO |
2012-01-24 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_3ebb2dc8460911e19f4700e0815b8da8.nasl - Type : ACT_GATHER_INFO |
2012-01-23 | Name : The remote Fedora host is missing a security update. File : fedora_2012-0435.nasl - Type : ACT_GATHER_INFO |
2012-01-13 | Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_4_11.nasl - Type : ACT_GATHER_INFO |
2012-01-13 | Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_6_5.nasl - Type : ACT_GATHER_INFO |
2011-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_wireshark-7796.nasl - Type : ACT_GATHER_INFO |
2011-12-13 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-111013.nasl - Type : ACT_GATHER_INFO |
2011-11-22 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2351.nasl - Type : ACT_GATHER_INFO |
2011-11-02 | Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_4_10.nasl - Type : ACT_GATHER_INFO |
2011-11-02 | Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_6_3.nasl - Type : ACT_GATHER_INFO |
2011-10-24 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_wireshark-7795.nasl - Type : ACT_GATHER_INFO |
2011-10-10 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201110-02.nasl - Type : ACT_GATHER_INFO |
2011-08-10 | Name : The remote Fedora host is missing a security update. File : fedora_2011-9638.nasl - Type : ACT_GATHER_INFO |
2011-08-10 | Name : The remote Fedora host is missing a security update. File : fedora_2011-9640.nasl - Type : ACT_GATHER_INFO |
2011-07-08 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2274.nasl - Type : ACT_GATHER_INFO |
2011-07-05 | Name : The remote host has an application that is affected by multiple denial of ser... File : wireshark_1_2_18.nasl - Type : ACT_GATHER_INFO |
2011-06-16 | Name : The remote Fedora host is missing a security update. File : fedora_2011-7858.nasl - Type : ACT_GATHER_INFO |
2011-06-16 | Name : The remote Fedora host is missing a security update. File : fedora_2011-7846.nasl - Type : ACT_GATHER_INFO |
2011-06-09 | Name : The remote Fedora host is missing a security update. File : fedora_2011-7821.nasl - Type : ACT_GATHER_INFO |
2011-06-02 | Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_4_7.nasl - Type : ACT_GATHER_INFO |
2011-06-02 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-105.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:56:37 |
|
2013-01-08 09:18:08 |
|