Integer overflow in the dissectsackchunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Duplicate TSN count.
epan/dissectors/packet-3g-a11.c in the 3GPP2 A11 dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a zero value in a sub-type length field.
The dissecteigrpmetriccomm function in epan/dissectors/packet-eigrp.c in the EIGRP dissector in Wireshark 1.8.x before 1.8.4 uses the wrong data type for a certain offset value, which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a malformed packet.
The dissectwtpcommon function in epan/dissectors/packet-wtp.c in the WTP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data type for a certain length field, which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a crafted value in a packet.
Integer overflow in the dissectiscsipdu function in epan/dissectors/packet-iscsi.c in the iSCSI dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
Integer overflow in the dissecticmpv6 function in epan/dissectors/packet-icmpv6.c in the ICMPv6 dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Number of Sources value.
epan/dissectors/packet-usb.c in the USB dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 relies on a length field to calculate an offset value, which allows remote attackers to cause a denial of service (infinite loop) via a zero value for this field.
Wireshark 1.8.x before 1.8.4 allows remote attackers to obtain sensitive hostname information by reading pcap-ng files.
The dissectrtcpapp function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
The dissectsflow245addresstype function in epan/dissectors/packet-sflow.c in the sFlow dissector in Wireshark 1.8.x before 1.8.4 does not properly handle length calculations for an invalid IP address type, which allows remote attackers to cause a denial of service (infinite loop) via a packet that is neither IPv4 nor IPv6.
The dissectisakmp function in epan/dissectors/packet-isakmp.c in the ISAKMP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data structure to determine IKEv2 decryption parameters, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Buffer overflow in the dissecttlv function in epan/dissectors/packet-ldp.c in the LDP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malformed packet.
The dissecthsrp function in epan/dissectors/packet-hsrp.c in the HSRP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
epan/dissectors/packet-ppp.c in the PPP dissector in Wireshark 1.8.x before 1.8.3 uses incorrect OUI data structures during the decoding of (1) PPP and (2) LCP data, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a malformed packet.
Description of problem: When opening certain capture files, wireshark hangs forever in an endless loop.
Version-Release number of selected component (if applicable): wireshark-1.6.8-1.fc16.x8664
I compiled wireshark 1.8.2 from source and did not see this problem any more.
How reproducible: always
Steps to Reproduce: 1. open capture file with wireshark Actual results: hangs after reading ~25% of the data
Expected results: opens file successfully
Additional info:
#0 tvbgetntohs (tvb=<optimized out>, offset=<optimized out>) at tvbuff.c:1163 #1 0x00007fe66e6884ca in dissectdrda (tvb=0x7fe673ab7a40, pinfo=0x7fff420367f0, tree=0x0) at packet-drda.c:695 #2 0x00007fe66e688a9f in dissectdrdaheur (tree=0x0, pinfo=0x7fff420367f0, tvb=0x7fe673ab7a40) at packet-drda.c:819 #3 dissectdrdaheur (tvb=0x7fe673ab7a40, pinfo=0x7fff420367f0, tree=0x0) at packet-drda.c:803 #4 0x00007fe66e472844 in dissectortryheuristic (subdissectors=<optimized out>, tvb=0x7fe673ab7a40, pinfo=0x7fff420367f0, tree=0x0) at packet.c:1657 #5 0x00007fe66ea32ba0 in decodetcpports (tvb=<optimized out>, offset=<optimized out>, pinfo=0x7fff420367f0, tree=0x0, srcport=<optimized out>, dstport=<optimized out>, tcpd=0x7fe656e2b080) at packet-tcp.c:3413 #6 0x00007fe66ea330a8 in processtcppayload (tvb=0x7fe673ab7980, offset=32, pinfo=0x7fff420367f0, tree=0x0, tcptree=0x0, srcport= 2049, dstport=676, seq=0, nxtseq=0, istcpsegment=0, tcpd=0x7fe656e2b080) at packet-tcp.c:3458 #7 0x00007fe66ea33651 in desegmenttcp (tcpd=0x7fe656e2b080, tcptree=0x0, tree=0x0, dport=676, sport=2049, nxtseq=128380061, seq= 128380023, offset=32, pinfo=0x7fff420367f0, tvb=0x7fe673ab7980) at packet-tcp.c:1708 #8 dissecttcppayload (tvb=0x7fe673ab7980, pinfo=0x7fff420367f0, offset=<optimized out>, seq=<optimized out>, nxtseq=128380061, sport= 2049, dport=676, tree=0x0, tcptree=0x0, tcpd=0x7fe656e2b080) at packet-tcp.c:3525 #9 0x00007fe66ea34ac0 in dissecttcp (tvb=<optimized out>, pinfo=0x7fff420367f0, tree=0x0) at packet-tcp.c:4233 #10 0x00007fe66e4706e0 in calldissectorthroughhandle (handle=0x7fe672eaafa0, tvb=0x7fe673ab7980, pinfo=0x7fff420367f0, tree=0x0) at packet.c:420 #11 0x00007fe66e470db5 in calldissectorwork (handle=0x7fe672eaafa0, tvb=0x7fe673ab7980, pinfoarg=0x7fff420367f0, tree=0x0, addprotoname=1) at packet.c:511 #12 0x00007fe66e4718e6 in dissectortryuintnew (subdissectors=<optimized out>, uintval=6, tvb=0x7fe673ab7980, pinfo=0x7fff420367f0, tree=0x0, addprotoname=1) at packet.c:923 #13 0x00007fe66e7a931d in dissectip (tvb=0x7fe673ab7b60, pinfo=<optimized out>, parenttree=0x0) at packet-ip.c:1841 #14 0x00007fe66e4706e0 in calldissectorthroughhandle (handle=0x7fe672aaff90, tvb=0x7fe673ab7b60, pinfo=0x7fff420367f0, tree=0x0) at packet.c:420 #15 0x00007fe66e470db5 in calldissectorwork (handle=0x7fe672aaff90, tvb=0x7fe673ab7b60, pinfoarg=0x7fff420367f0, tree=0x0, addprotoname=1) at packet.c:511 #16 0x00007fe66e4718e6 in dissectortryuintnew (subdissectors=<optimized out>, uintval=2048, tvb=0x7fe673ab7b60, pinfo= 0x7fff420367f0, tree=0x0, addprotoname=1) at packet.c:923 #17 0x00007fe66e6b21d7 in ethertype (etype=2048, tvb=0x7fe673ab7aa0, offsetafteretype=14, pinfo=0x7fff420367f0, tree=0x0, fhtree=0x0, etypeid=18803, trailerid=18805, fcslen=-1) at packet-ethertype.c:262 #18 0x00007fe66e6b0e59 in dissectethcommon (tvb=0x7fe673ab7aa0, pinfo=0x7fff420367f0, parenttree=0x0, fcslen=-1) at packet-eth.c:348 #19 0x00007fe66e4706e0 in calldissectorthroughhandle (handle=0x7fe6729356b0, tvb=0x7fe673ab7aa0, pinfo=0x7fff420367f0, tree=0x0) at packet.c:420 #20 0x00007fe66e470db5 in calldissectorwork (handle=0x7fe6729356b0, tvb=0x7fe673ab7aa0, pinfoarg=0x7fff420367f0, tree=0x0, addprotoname=1) at packet.c:511 #21 0x00007fe66e4718e6 in dissectortryuintnew (subdissectors=<optimized out>, uintval=1, tvb=0x7fe673ab7aa0, pinfo=0x7fff420367f0, tree=0x0, addprotoname=1) at packet.c:923 ---Type <return> to continue, or q <return> to quit--- #22 0x00007fe66e6e5ea9 in dissectframe (tvb=0x7fe673ab7aa0, pinfo=0x7fff420367f0, parenttree=0x0) at packet-frame.c:345 #23 0x00007fe66e4706e0 in calldissectorthroughhandle (handle=0x7fe67297b180, tvb=0x7fe673ab7aa0, pinfo=0x7fff420367f0, tree=0x0) at packet.c:420 #24 0x00007fe66e470db5 in calldissectorwork (handle=0x7fe67297b180, tvb=0x7fe673ab7aa0, pinfoarg=0x7fff420367f0, tree=0x0, addprotoname=1) at packet.c:511 #25 0x00007fe66e473171 in calldissector (handle=<optimized out>, tvb=0x7fe673ab7aa0, pinfo=0x7fff420367f0, tree=0x0) at packet.c:1864 #26 0x00007fe66e473594 in dissectpacket (edt=0x7fff420367e0, pseudoheader=0x0, pd=0x7fe673a2e890 "", fd=0x7fe673f6c6d0, cinfo=0x0) at packet.c:351 #27 0x00007fe6711311fd in addpackettopacketlist (fdata=0x7fe673f6c6d0, cf=0x7fe6714e6e60, dfcode=0x0, filteringtaplisteners=0, tapflags=<optimized out>, pseudoheader=0x7fe6739f6c40, buf=0x7fe673a2e890 "", addtopacketlist=1, refilter=1) at file.c:1111 #28 0x00007fe6711314aa in readpacket (cf=0x7fe6714e6e60, dfcode=0x0, filteringtaplisteners=0, tapflags=4, offset=<optimized out>) at file.c:1200 #29 0x00007fe671131d48 in cfread (cf=0x7fe6714e6e60, fromsave=0) at file.c:609 #30 0x00007fe67111db5f in main (argc=0, argv=0x7fff42037428) at main.c:2877
The code hangs in this loop:
dissectdrda () { [...] 693 while ((guint) (offset + 10) <= tvblength(tvb)) 694 { 695 iCommand = tvbgetntohs(tvb, offset + 8); 696 iLength = tvbgetntohs(tvb, offset + 0); 697 / iCommandEnd is the length of the packet up to the end of the current command / 698 iCommandEnd += iLength; [...] 707 if (tree) 708 { [...] 776 } 777 else 778 { 779 / No tree, advance directly to next command / (gdb) 780 offset += iLength; 781 } 782 }
tvbgetntohs() in line 696 returns 0, thus the "offset" variable never advances.
The dissectmqrr function in epan/dissectors/packet-mq.c in the MQ dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 does not properly determine when to enter a certain loop, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Buffer overflow in the RTPS dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.
epan/dissectors/packet-assar3.c in the ASSA R3 dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Unspecified vulnerability in the LDAP dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.
The dissectnbapTdCHID function in epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 does not restrict the dchid value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
The netmonopen function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file.
epan/proto.c in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop) via a crafted packet that is not properly handled by the GSM RR dissector.
The parseFields function in epan/dissectors/packet-dis-pdus.c in the DIS dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not terminate packet-data processing after finding zero remaining bytes, which allows remote attackers to cause a denial of service (loop) via a crafted packet.
The dissectperlengthdeterminant function in epan/dissectors/packet-per.c in the ASN.1 PER dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize a length field in certain abnormal situations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
The dissectdvbcitpduhdr function in epan/dissectors/packet-dvbci.c in the DVB-CI dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not validate a certain length value before decrementing it, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.
Integer signedness error in the gettypelength function in epan/dissectors/packet-btsdp.c in the Bluetooth SDP dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet.
Multiple array index errors in epan/dissectors/packet-gsmacommon.c in the GSM A Common dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allow remote attackers to cause a denial of service (application crash) via a crafted packet.
The netmonopen function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize certain structure members, which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file.
The dissectdsmccundownload function in epan/dissectors/packet-mpeg-dsmcc.c in the MPEG DSM-CC dissector in Wireshark 1.8.x before 1.8.7 uses an incorrect format string, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Multiple integer overflows in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (loop or application crash) via a malformed packet, related to a crash of the Websocket dissector, an infinite loop in the MySQL dissector, and a large loop in the ETCH dissector.