Stack consumption vulnerability in the dissectberchoice function in the BER dissector in Wireshark 1.2.x through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of service (infinite loop) via vectors involving self-referential ASN.1 CHOICE values.
A buffer overflow flaw was found in the way that Wireshark 1.4.0 through 1.4.9 and 1.6.0 through 1.6.2 handled reading ERF files. This could cause wireshark to crash by reading a malformed packet trace file. This is corrected in wireshark 1.6.3.
References:
https://bugs.wireshark.org/bugzilla/showbug.cgi?id=6479 http://anonsvn.wireshark.org/viewvc?view=revision&revision=39508
External References:
http://www.wireshark.org/security/wnpa-sec-2011-19.html
A flaw in the Infiniband dissector could cause Wireshark 1.4.0 through 1.4.9 and 1.6.0 through 1.6.3 to crash by dereferencing a NULL pointer by reading a malformed packet trace file or if someone were to inject a malformed packet onto the wire. This is corrected in wireshark 1.6.3
References:
https://bugs.wireshark.org/bugzilla/showbug.cgi?id=6476 http://anonsvn.wireshark.org/viewvc?view=revision&revision=39500
External References:
http://www.wireshark.org/security/wnpa-sec-2011-18.html
The prototreeadditem function in Wireshark 1.6.0 through 1.6.1 and 1.4.0 through 1.4.8, when the IKEv1 protocol dissector is used, allows user-assisted remote attackers to cause a denial of service (infinite loop) via vectors involving a malformed IKE packet and many items in a tree.
The Lucent/Ascend file parser in Wireshark 1.2.x before 1.2.18, 1.4.x through 1.4.7, and 1.6.0 allows remote attackers to cause a denial of service (infinite loop) via malformed packets.
An infinite loop was found in the way ANSI A Interface (IS-634/IOS) dissector of the Wireshark network traffic analyzer processed certain ANSI A MAP capture files. If Wireshark read a malformed packet off a network or opened a malicious packet capture file, it could lead to denial of service (Wireshark hang).
Upstream bug: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=6044
Public PoC: [2] http://www.wireshark.org/download/automated/captures/fuzz-2011-06-20-22762.pcap
Relevant upstream patch: [3] http://anonsvn.wireshark.org/viewvc?view=revision&revision=37930
References: [4] http://www.wireshark.org/security/ [5] http://www.wireshark.org/security/wnpa-sec-2011-11.html [6] http://www.wireshark.org/security/wnpa-sec-2011-10.html
An integer underflow flaw, leading to heap-based buffer over-read was found in the Wireshark's Visual Networks dissector. A remote attacker could create a specially-crafted capture file, which once opened, by a local, unsuspecting user could lead to wireshark application crash.
References: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=5934 (upstream bug report) [2] https://bugs.wireshark.org/bugzilla/attachment.cgi?id=6366 (reproducer) [3] http://www.openwall.com/lists/oss-security/2011/05/31/20 (CVE request) [4] http://www.wireshark.org/security/wnpa-sec-2011-07.html (upstream advisory)
Upstream patch: [5] http://anonsvn.wireshark.org/viewvc?view=revision&revision=37128
A double free flaw was found in the way Wireshark uncompressed a zlib compressed packet inside a message of tvbuff buffer. A remote attacker could create a specially-crafted capture file, which once opened, by a local, unsuspecting user could lead to wireshark application crash.
References: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=5908 (upstream bug report, not public) [2] http://www.openwall.com/lists/oss-security/2011/05/31/20 (CVE request) [3] http://www.wireshark.org/security/wnpa-sec-2011-07.html (upstream advisory)
Upstream patch: [4] http://anonsvn.wireshark.org/viewvc?view=revision&revision=37081
It was found that Wireshark's DICOM dissector did not check for invalid payload data unit length. A remote attacker could create a specially-crafted capture file, which once opened, by a local, unsuspecting user could lead to wireshark application hang / termination.
References: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=5876 (upstream bug report) [2] http://www.wireshark.org/download/automated/captures/fuzz-2011-04-30-7272.pcap (public reproducer) [3] http://www.openwall.com/lists/oss-security/2011/05/31/20 (CVE request) [4] http://www.wireshark.org/security/wnpa-sec-2011-07.html (upstream advisory)
Upstream patch: [5] http://anonsvn.wireshark.org/viewvc?view=revision&revision=36958
A NULL pointer dereference flaw was found in the way Wireshark processed certain Diameter dictionary files. A remote attacker could create a specially-crafted dictionary file, which once used, by a local, unsuspecting user when loading a Diameter capture file could lead to wireshark application crash.
References: [1] http://www.openwall.com/lists/oss-security/2011/05/31/20 (CVE request) [2] http://www.wireshark.org/security/wnpa-sec-2011-07.html (upstream advisory)
A stack-based buffer over-read flaw was found in the way Wireshark performed management of testy, virtualizable buffers. A remote attacker could create a specially-crafted capture file, which once opened, by a local, unsuspecting user could lead to wireshark application crash.
References: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=5912 (upstream bug report) [2] https://bugs.wireshark.org/bugzilla/attachment.cgi?id=6335 (public reproducer) [3] http://www.openwall.com/lists/oss-security/2011/05/31/20 (CVE request) [4] http://www.wireshark.org/security/wnpa-sec-2011-07.html (upstream advisory)
Upstream patch: [5] http://anonsvn.wireshark.org/viewvc?view=revision&revision=37068
The NFS dissector in epan/dissectors/packet-nfs.c in Wireshark 1.4.x before 1.4.5 on Windows uses an incorrect integer data type during decoding of SETCLIENTID calls, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file.
The X.509if dissector in Wireshark 1.2.x before 1.2.16 and 1.4.x before 1.4.5 does not properly initialize certain global variables, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file.
The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted packet, as demonstrated by a usbmon dump.
epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet.
Multiple integer underflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers to cause a denial of service (loop) via vectors related to the R3 dissector, a different vulnerability than CVE-2012-2392.
Multiple integer overflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers to cause a denial of service (infinite loop) via vectors related to the (1) BACapp and (2) Bluetooth HCI dissectors, a different vulnerability than CVE-2012-2392.
epan/dissectors/packet-diameter.c in the DIAMETER dissector in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 does not properly construct certain array data structures, which allows remote attackers to cause a denial of service (application crash) via a crafted packet that triggers incorrect memory allocation.
Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 on the SPARC and Itanium platforms does not properly perform data alignment for a certain structure member, which allows remote attackers to cause a denial of service (application crash) via a (1) ICMP or (2) ICMPv6 Echo Request packet.
Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allows remote attackers to cause a denial of service (infinite loop) via vectors related to the (1) ANSI MAP, (2) ASF, (3) IEEE 802.11, (4) IEEE 802.3, and (5) LTP dissectors.
The lanalyzerread function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a Novell capture file containing a record that is too small.
wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in an AIX iptrace file.
Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or (3) NETMON 2 capture file.