CVE-2011-1957: Medium severity wireshark vulnerability
It was found that Wireshark's DICOM dissector did not check for invalid payload data unit length. A remote attacker could create a specially-crafted capture file, which once opened, by a local, unsuspecting user could lead to wireshark application hang / termination.
References: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=5876 (upstream bug report) [2] http://www.wireshark.org/download/automated/captures/fuzz-2011-04-30-7272.pcap (public reproducer) [3] http://www.openwall.com/lists/oss-security/2011/05/31/20 (CVE request) [4] http://www.wireshark.org/security/wnpa-sec-2011-07.html (upstream advisory)
Upstream patch: [5] http://anonsvn.wireshark.org/viewvc?view=revision&revision=36958
Other sources
The dissectdcmmain function in epan/dissectors/packet-dcm.c in the DICOM dissector in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (infinite loop) via an invalid PDU length.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1957?
CVE-2011-1957 has a medium severity level as it can lead to application hang or termination.
How do I fix CVE-2011-1957?
To fix CVE-2011-1957, update Wireshark to a version later than 1.2.16.
Which versions of Wireshark are affected by CVE-2011-1957?
CVE-2011-1957 affects Wireshark versions 1.2.0 through 1.2.16.
What kind of attack is possible with CVE-2011-1957?
An attacker can create a specially-crafted capture file that, when opened, can cause Wireshark to hang or terminate.
Is CVE-2011-1957 a remote vulnerability?
Yes, CVE-2011-1957 can be exploited remotely by using a malicious capture file.