CVE-2011-4102: Buffer Overflow
A buffer overflow flaw was found in the way that Wireshark 1.4.0 through 1.4.9 and 1.6.0 through 1.6.2 handled reading ERF files. This could cause wireshark to crash by reading a malformed packet trace file. This is corrected in wireshark 1.6.3.
References:
https://bugs.wireshark.org/bugzilla/showbug.cgi?id=6479 http://anonsvn.wireshark.org/viewvc?view=revision&revision=39508
External References:
http://www.wireshark.org/security/wnpa-sec-2011-19.html
Other sources
Heap-based buffer overflow in the erfreadheader function in wiretap/erf.c in the ERF file parser in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (application crash) via a malformed file.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4102?
CVE-2011-4102 is classified as a medium severity vulnerability due to its potential to crash the Wireshark application.
How do I fix CVE-2011-4102?
To fix CVE-2011-4102, upgrade Wireshark to version 1.6.3 or later.
Which versions of Wireshark are affected by CVE-2011-4102?
CVE-2011-4102 affects Wireshark versions 1.4.0 through 1.4.9 and 1.6.0 through 1.6.2.
What type of vulnerability is CVE-2011-4102?
CVE-2011-4102 is a buffer overflow vulnerability that occurs when reading malformed ERF files.
Can CVE-2011-4102 lead to remote code execution?
CVE-2011-4102 does not directly lead to remote code execution, but it can cause the application to crash.