Stack consumption vulnerability in the dissectberchoice function in the BER dissector in Wireshark 1.2.x through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of service (infinite loop) via vectors involving self-referential ASN.1 CHOICE values.
The lanalyzerread function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a Novell capture file containing a record that is too small.
wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in an AIX iptrace file.
Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or (3) NETMON 2 capture file.
It was found that Wireshark's DICOM dissector did not check for invalid payload data unit length. A remote attacker could create a specially-crafted capture file, which once opened, by a local, unsuspecting user could lead to wireshark application hang / termination.
References: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=5876 (upstream bug report) [2] http://www.wireshark.org/download/automated/captures/fuzz-2011-04-30-7272.pcap (public reproducer) [3] http://www.openwall.com/lists/oss-security/2011/05/31/20 (CVE request) [4] http://www.wireshark.org/security/wnpa-sec-2011-07.html (upstream advisory)
Upstream patch: [5] http://anonsvn.wireshark.org/viewvc?view=revision&revision=36958
A NULL pointer dereference flaw was found in the way Wireshark processed certain Diameter dictionary files. A remote attacker could create a specially-crafted dictionary file, which once used, by a local, unsuspecting user when loading a Diameter capture file could lead to wireshark application crash.
References: [1] http://www.openwall.com/lists/oss-security/2011/05/31/20 (CVE request) [2] http://www.wireshark.org/security/wnpa-sec-2011-07.html (upstream advisory)
A stack-based buffer over-read flaw was found in the way Wireshark performed management of testy, virtualizable buffers. A remote attacker could create a specially-crafted capture file, which once opened, by a local, unsuspecting user could lead to wireshark application crash.
References: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=5912 (upstream bug report) [2] https://bugs.wireshark.org/bugzilla/attachment.cgi?id=6335 (public reproducer) [3] http://www.openwall.com/lists/oss-security/2011/05/31/20 (CVE request) [4] http://www.wireshark.org/security/wnpa-sec-2011-07.html (upstream advisory)
Upstream patch: [5] http://anonsvn.wireshark.org/viewvc?view=revision&revision=37068
An integer underflow flaw, leading to heap-based buffer over-read was found in the Wireshark's Visual Networks dissector. A remote attacker could create a specially-crafted capture file, which once opened, by a local, unsuspecting user could lead to wireshark application crash.
References: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=5934 (upstream bug report) [2] https://bugs.wireshark.org/bugzilla/attachment.cgi?id=6366 (reproducer) [3] http://www.openwall.com/lists/oss-security/2011/05/31/20 (CVE request) [4] http://www.wireshark.org/security/wnpa-sec-2011-07.html (upstream advisory)
Upstream patch: [5] http://anonsvn.wireshark.org/viewvc?view=revision&revision=37128
A double free flaw was found in the way Wireshark uncompressed a zlib compressed packet inside a message of tvbuff buffer. A remote attacker could create a specially-crafted capture file, which once opened, by a local, unsuspecting user could lead to wireshark application crash.
References: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=5908 (upstream bug report, not public) [2] http://www.openwall.com/lists/oss-security/2011/05/31/20 (CVE request) [3] http://www.wireshark.org/security/wnpa-sec-2011-07.html (upstream advisory)
Upstream patch: [4] http://anonsvn.wireshark.org/viewvc?view=revision&revision=37081
The NFS dissector in epan/dissectors/packet-nfs.c in Wireshark 1.4.x before 1.4.5 on Windows uses an incorrect integer data type during decoding of SETCLIENTID calls, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file.
The X.509if dissector in Wireshark 1.2.x before 1.2.16 and 1.4.x before 1.4.5 does not properly initialize certain global variables, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file.
The Lucent/Ascend file parser in Wireshark 1.2.x before 1.2.18, 1.4.x through 1.4.7, and 1.6.0 allows remote attackers to cause a denial of service (infinite loop) via malformed packets.
A buffer overflow flaw was found in the way that Wireshark 1.4.0 through 1.4.9 and 1.6.0 through 1.6.2 handled reading ERF files. This could cause wireshark to crash by reading a malformed packet trace file. This is corrected in wireshark 1.6.3.
References:
https://bugs.wireshark.org/bugzilla/showbug.cgi?id=6479 http://anonsvn.wireshark.org/viewvc?view=revision&revision=39508
External References:
http://www.wireshark.org/security/wnpa-sec-2011-19.html
A flaw in the Infiniband dissector could cause Wireshark 1.4.0 through 1.4.9 and 1.6.0 through 1.6.3 to crash by dereferencing a NULL pointer by reading a malformed packet trace file or if someone were to inject a malformed packet onto the wire. This is corrected in wireshark 1.6.3
References:
https://bugs.wireshark.org/bugzilla/showbug.cgi?id=6476 http://anonsvn.wireshark.org/viewvc?view=revision&revision=39500
External References:
http://www.wireshark.org/security/wnpa-sec-2011-18.html
An infinite loop was found in the way ANSI A Interface (IS-634/IOS) dissector of the Wireshark network traffic analyzer processed certain ANSI A MAP capture files. If Wireshark read a malformed packet off a network or opened a malicious packet capture file, it could lead to denial of service (Wireshark hang).
Upstream bug: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=6044
Public PoC: [2] http://www.wireshark.org/download/automated/captures/fuzz-2011-06-20-22762.pcap
Relevant upstream patch: [3] http://anonsvn.wireshark.org/viewvc?view=revision&revision=37930
References: [4] http://www.wireshark.org/security/ [5] http://www.wireshark.org/security/wnpa-sec-2011-11.html [6] http://www.wireshark.org/security/wnpa-sec-2011-10.html
epan/dissectors/packet-diameter.c in the DIAMETER dissector in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 does not properly construct certain array data structures, which allows remote attackers to cause a denial of service (application crash) via a crafted packet that triggers incorrect memory allocation.
Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 on the SPARC and Itanium platforms does not properly perform data alignment for a certain structure member, which allows remote attackers to cause a denial of service (application crash) via a (1) ICMP or (2) ICMPv6 Echo Request packet.
Multiple integer underflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers to cause a denial of service (loop) via vectors related to the R3 dissector, a different vulnerability than CVE-2012-2392.
Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allows remote attackers to cause a denial of service (infinite loop) via vectors related to the (1) ANSI MAP, (2) ASF, (3) IEEE 802.11, (4) IEEE 802.3, and (5) LTP dissectors.
Multiple integer overflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers to cause a denial of service (infinite loop) via vectors related to the (1) BACapp and (2) Bluetooth HCI dissectors, a different vulnerability than CVE-2012-2392.
The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted packet, as demonstrated by a usbmon dump.
epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet.
The prototreeadditem function in Wireshark 1.6.0 through 1.6.1 and 1.4.0 through 1.4.8, when the IKEv1 protocol dissector is used, allows user-assisted remote attackers to cause a denial of service (infinite loop) via vectors involving a malformed IKE packet and many items in a tree.