Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Wireshark Endace ERF unsigned integer wrap vulnerability
Informations
Name VU#676492 First vendor Publication 2009-10-05
Vendor VU-CERT Last vendor Modification 2009-11-24
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#676492

Wireshark Endace ERF unsigned integer wrap vulnerability

Overview

Wireshark contains an unsigned integer wrap vulnerability that may occur when parsing Endace Extensible Record Format (ERF) files.

I. Description

Wireshark is a protocol analyzer that can open or import previously saved files. When processing an Endace ERF file an unsigned integer wrap vulnerability may cause Wireshark to allocate a very large buffer. To exploit this issue, an attacker would have to convince a user to open a crafted ERF file using Wireshark.

This issue also affects Tshark, the console version of Wireshark.

II. Impact

A remote attacker can cause Wireshark to crash. It may be possible, although unlikely, for an attacker to execute arbitrary code. Exploiting the vulnerability could result in a NULL pointer dereference, which can lead to code execution on certain platforms.

III. Solution

Update

Wireshark 1.2.2 has been released to address this and other issues.

Do not run Wireshark with root or administrator privileges

Running Wireshark with a limited user account will reduce the impact of this and other vulnerabilities.

Systems Affected

VendorStatusDate NotifiedDate Updated
WiresharkVulnerable2009-10-05

References


http://www.wireshark.org/docs/relnotes/wireshark-1.2.2.html
http://anonsvn.wireshark.org/viewvc/trunk/wiretap/erf.c?view=markup&pathrev=29364
https://www.securecoding.cert.org/confluence/display/cplusplus/INT30-CPP.+Ensure+that+unsigned+integer+operations+do+not+wrap
http://wiki.wireshark.org/Security#head-ac69042aeeb98cdaed2ec2ff1bd2c983fa03cffd
http://xorl.wordpress.com/2009/11/10/cve-2009-3829-wireshark-endace-erf-protocol-integer-underflow/
http://www.juniper.net/solutions/literature/white_papers/Vector-Rewrite-Attack.pdf

Credit

This issue was discovered by Ryan Giobbi.

This document was written by Ryan Giobbi and Art Manion.

Other Information

Date Public:2009-09-15
Date First Published:2009-10-05
Date Last Updated:2009-11-24
CERT Advisory: 
CVE-ID(s): 
NVD-ID(s): 
US-CERT Technical Alerts: 
Metric:1.28
Document Revision:27

Original Source

Url : http://www.kb.cert.org/vuls/id/676492

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-189 Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13282
 
Oval ID: oval:org.mitre.oval:def:13282
Title: DSA-1942-1 wireshark -- several
Description: Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-2560 A NULL pointer dereference was found in the RADIUS dissector. CVE-2009-3550 A NULL pointer dereference was found in the DCERP/NT dissector. CVE-2009-3829 An integer overflow was discovered in the ERF parser. This update also includes fixes for three minor issues, which were scheduled for the next stable point update. Also CVE-2009-1268 was fixed for Etch. Since this security update was issued prior to the release of the point update, the fixes were included. For the old stable distribution, this problem has been fixed in version 0.99.4-5.etch.4. For the stable distribution, this problem has been fixed in version 1.0.2-3+lenny7. For the unstable distribution these problems have been fixed in version 1.2.3-1. We recommend that you upgrade your Wireshark packages.
Family: unix Class: patch
Reference(s): DSA-1942-1
CVE-2009-1268
CVE-2008-1829
CVE-2009-2560
CVE-2009-2562
CVE-2009-3241
CVE-2009-3550
CVE-2009-3829
 Version: 5
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
 Product(s): wireshark
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:5979
 
Oval ID: oval:org.mitre.oval:def:5979
Title: Wireshark Integer overflow vulnerability in wiretap/erf.c
Description: Integer overflow in wiretap/erf.c in Wireshark before 1.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted erf file, related to an "unsigned integer wrap vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-3829
 Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows XP
Microsoft Windows 8
Microsoft Windows Server 2012
 Product(s): Wireshark
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7586
 
Oval ID: oval:org.mitre.oval:def:7586
Title: DSA-1942 wireshark -- several vulnerabilities
Description: Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems: A NULL pointer dereference was found in the RADIUS dissector. A NULL pointer dereference was found in the DCERP/NT dissector. An integer overflow was discovered in the ERF parser. This update also includes fixes for three minor issues (CVE-2008-1829, CVE-2009-2562, CVE-2009-3241), which were scheduled for the next stable point update. Also CVE-2009-1268 was fixed for Etch. Since this security update was issued prior to the release of the point update, the fixes were included.
Family: unix Class: patch
Reference(s): DSA-1942
CVE-2009-1268
CVE-2008-1829
CVE-2009-2560
CVE-2009-2562
CVE-2009-3241
CVE-2009-3550
CVE-2009-3829
 Version: 3
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
 Product(s): wireshark
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9945
 
Oval ID: oval:org.mitre.oval:def:9945
Title: Integer overflow in wiretap/erf.c in Wireshark before 1.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted erf file, related to an "unsigned integer wrap vulnerability."
Description: Integer overflow in wiretap/erf.c in Wireshark before 1.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted erf file, related to an "unsigned integer wrap vulnerability."
Family: unix Class: vulnerability
Reference(s): CVE-2009-3829
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 62

OpenVAS Exploits

Date Description
2011-08-09 Name : CentOS Update for wireshark CESA-2010:0360 centos5 i386
File : nvt/gb_CESA-2010_0360_wireshark_centos5_i386.nasl
2010-04-29 Name : CentOS Update for wireshark CESA-2010:0360 centos3 i386
File : nvt/gb_CESA-2010_0360_wireshark_centos3_i386.nasl
2010-04-29 Name : CentOS Update for wireshark CESA-2010:0360 centos4 i386
File : nvt/gb_CESA-2010_0360_wireshark_centos4_i386.nasl
2010-04-29 Name : RedHat Update for wireshark RHSA-2010:0360-01
File : nvt/gb_RHSA-2010_0360-01_wireshark.nasl
2009-12-14 Name : SLES11: Security update for wireshark
File : nvt/sles11_wireshark1.nasl
2009-12-10 Name : Debian Security Advisory DSA 1942-1 (wireshark)
File : nvt/deb_1942_1.nasl
2009-12-10 Name : Mandriva Security Advisory MDVSA-2009:292-1 (wireshark)
File : nvt/mdksa_2009_292_1.nasl
2009-12-03 Name : Gentoo Security Advisory GLSA 200911-05 (wireshark)
File : nvt/glsa_200911_05.nasl
2009-11-11 Name : Mandriva Security Advisory MDVSA-2009:292 (wireshark)
File : nvt/mdksa_2009_292.nasl
2009-11-04 Name : Wireshark 'wiretap/erf.c' Unsigned Integer Wrap Vulnerability - Nov09 (Linux)
File : nvt/gb_wireshark_wiretap_dos_vuln_nov09_lin.nasl
2009-11-04 Name : Wireshark 'wiretap/erf.c' Unsigned Integer Wrap Vulnerability - Nov09 (Win)
File : nvt/gb_wireshark_wiretap_dos_vuln_nov09_win.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
59478 Wireshark wiretap/erf.c Unsigned Integer Wrap ERF File Handling Overflow

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0360.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100420_wireshark_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2010-05-11 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0360.nasl - Type : ACT_GATHER_INFO
2010-04-22 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0360.nasl - Type : ACT_GATHER_INFO
2010-02-24 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1942.nasl - Type : ACT_GATHER_INFO
2009-12-09 Name : The remote SuSE 11 host is missing a security update.
File : suse_11_wireshark-091125.nasl - Type : ACT_GATHER_INFO
2009-12-04 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-292.nasl - Type : ACT_GATHER_INFO
2009-12-01 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_wireshark-091125.nasl - Type : ACT_GATHER_INFO
2009-12-01 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_wireshark-091125.nasl - Type : ACT_GATHER_INFO
2009-12-01 Name : The remote openSUSE host is missing a security update.
File : suse_11_2_wireshark-091125.nasl - Type : ACT_GATHER_INFO
2009-11-30 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200911-05.nasl - Type : ACT_GATHER_INFO