Vulnerabilities > CVE-2009-1269 - Denial Of Service vulnerability in Wireshark Prior to 1.0.7

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
wireshark
nessus

Summary

Unspecified vulnerability in Wireshark 0.99.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted Tektronix .rf5 file.

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2009-5382.NASL
    descriptionUpdate to 1.0.8 fixes various security flaws. http://www.wireshark.org/security/wnpa-sec-2009-03.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id38907
    published2009-05-26
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/38907
    titleFedora 10 : wireshark-1.0.8-1.fc10 (2009-5382)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2009-5382.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(38907);
      script_version ("1.15");
      script_cvs_date("Date: 2019/08/02 13:32:30");
    
      script_cve_id("CVE-2009-1210", "CVE-2009-1268", "CVE-2009-1269", "CVE-2009-1829");
      script_bugtraq_id(35081);
      script_xref(name:"FEDORA", value:"2009-5382");
    
      script_name(english:"Fedora 10 : wireshark-1.0.8-1.fc10 (2009-5382)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Update to 1.0.8 fixes various security flaws.
    http://www.wireshark.org/security/wnpa-sec-2009-03.html
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      # http://www.wireshark.org/security/wnpa-sec-2009-03.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.wireshark.org/security/wnpa-sec-2009-03.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=501929"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2009-May/024114.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?fdd4af27"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected wireshark package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_cwe_id(20, 134);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:wireshark");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:10");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/05/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/05/26");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^10([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 10.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC10", reference:"wireshark-1.0.8-1.fc10")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "wireshark");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_WIRESHARK-090525.NASL
    descriptionVersion upgrade to Wireshark 1.0.7 to fix various vulnerabilities: CVE-2009-1269: crash while loading a Tektronix .rf5 file CVE-2009-1268: crash in Check Point High-Availability Protocol (CPHAP) dissector CVE-2009-1267: LDAP dissector could crash on Windows CVE-2009-1210: PROFINET format string bug CVE-2009-1266: additional PROFINET format string bugs, a crash in the PCNFSD dissector
    last seen2020-06-01
    modified2020-06-02
    plugin id40323
    published2009-07-21
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40323
    titleopenSUSE Security Update : wireshark (wireshark-912)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update wireshark-912.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40323);
      script_version("1.12");
      script_cvs_date("Date: 2019/10/25 13:36:35");
    
      script_cve_id("CVE-2009-1210", "CVE-2009-1266", "CVE-2009-1267", "CVE-2009-1268", "CVE-2009-1269");
    
      script_name(english:"openSUSE Security Update : wireshark (wireshark-912)");
      script_summary(english:"Check for the wireshark-912 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Version upgrade to Wireshark 1.0.7 to fix various vulnerabilities:
    CVE-2009-1269: crash while loading a Tektronix .rf5 file
    CVE-2009-1268: crash in Check Point High-Availability Protocol (CPHAP)
    dissector CVE-2009-1267: LDAP dissector could crash on Windows
    CVE-2009-1210: PROFINET format string bug CVE-2009-1266: additional
    PROFINET format string bugs, a crash in the PCNFSD dissector"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=493584"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected wireshark packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_cwe_id(20, 134);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wireshark");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wireshark-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/05/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/21");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE11\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE11.1", reference:"wireshark-1.0.4-2.9.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"wireshark-devel-1.0.4-2.9.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "wireshark / wireshark-devel");
    }
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20090615_WIRESHARK_ON_SL3_X.NASL
    descriptionA format string flaw was found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-1210) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-1268, CVE-2009-1269, CVE-2009-1829) All running instances of Wireshark must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id60596
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60596
    titleScientific Linux Security Update : wireshark on SL3.x, SL4.x, SL5.x i386/x86_64
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_WIRESHARK-090525.NASL
    descriptionVersion upgrade to Wireshark 1.0.7 to fix various vulnerabilities: CVE-2009-1269: crash while loading a Tektronix .rf5 file CVE-2009-1268: crash in Check Point High-Availability Protocol (CPHAP) dissector CVE-2009-1267: LDAP dissector could crash on Windows CVE-2009-1210: PROFINET format string bug CVE-2009-1266: additional PROFINET format string bugs, a crash in the PCNFSD dissector
    last seen2020-06-01
    modified2020-06-02
    plugin id40154
    published2009-07-21
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40154
    titleopenSUSE Security Update : wireshark (wireshark-912)
  • NASL familyWindows
    NASL idWIRESHARK_1_0_7.NASL
    descriptionThe installed version of Wireshark or Ethereal is affected by multiple issues : - The PROFINET dissector is affected by a format string vulnerability which an attacker could exploit to execute arbitrary code. (Bug 3372) - Wireshark could crash while reading a malformed LDAP capture file. (Bug 3262) - Wireshark could crash while reading a malformed Check Point High-Availability Protocol capture file. (Bug 3269) - Wireshark could crash while reading a Tektronix .rf5 capture file. (Bug 3366)
    last seen2020-06-01
    modified2020-06-02
    plugin id36127
    published2009-04-10
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/36127
    titleWireshark / Ethereal 0.99.2 to 1.0.6 Multiple Vulnerabilities
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2009-088.NASL
    descriptionMultiple vulnerabilities has been identified and corrected in wireshark : o The PROFINET dissector was vulnerable to a format string overflow (CVE-2009-1210). o The Check Point High-Availability Protocol (CPHAP) dissecto could crash (CVE-2009-1268). o Wireshark could crash while loading a Tektronix .rf5 file (CVE-2009-1269). This update provides Wireshark 1.0.7, which is not vulnerable to these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id36918
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/36918
    titleMandriva Linux Security Advisory : wireshark (MDVSA-2009:088)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200906-05.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200906-05 (Wireshark: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Wireshark: David Maciejak discovered a vulnerability in packet-usb.c in the USB dissector via a malformed USB Request Block (URB) (CVE-2008-4680). Florent Drouin and David Maciejak reported an unspecified vulnerability in the Bluetooth RFCOMM dissector (CVE-2008-4681). A malformed Tamos CommView capture file (aka .ncf file) with an
    last seen2020-06-01
    modified2020-06-02
    plugin id39580
    published2009-07-01
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/39580
    titleGLSA-200906-05 : Wireshark: Multiple vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE9_12424.NASL
    descriptionVersion upgrade to Wireshark 1.0.7 to fix various vulnerabilities : - crash while loading a Tektronix .rf5 file. (CVE-2009-1269) - crash in Check Point High-Availability Protocol (CPHAP) dissector. (CVE-2009-1268) - LDAP dissector could crash on Windows. (CVE-2009-1267) - PROFINET format string bug. (CVE-2009-1210) - additional PROFINET format string bugs, a crash in the PCNFSD dissector. (CVE-2009-1266)
    last seen2020-06-01
    modified2020-06-02
    plugin id41303
    published2009-09-24
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/41303
    titleSuSE9 Security Update : ethereal (YOU Patch Number 12424)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1785.NASL
    descriptionSeveral remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-1210 A format string vulnerability was discovered in the PROFINET dissector. - CVE-2009-1268 The dissector for the Check Point High-Availability Protocol could be forced to crash. - CVE-2009-1269 Malformed Tektronix files could lead to a crash. The old stable distribution (etch), is only affected by the CPHAP crash, which doesn
    last seen2020-06-01
    modified2020-06-02
    plugin id38666
    published2009-05-04
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/38666
    titleDebian DSA-1785-1 : wireshark - several vulnerabilities
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2009-1100.NASL
    descriptionFrom Red Hat Security Advisory 2009:1100 : Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal. A format string flaw was found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-1210) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-1268, CVE-2009-1269, CVE-2009-1829) Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.8, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id67871
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67871
    titleOracle Linux 3 / 4 / 5 : wireshark (ELSA-2009-1100)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_ETHEREAL-6269.NASL
    descriptionVersion upgrade to Wireshark 1.0.7 to fix various vulnerabilities : - crash while loading a Tektronix .rf5 file CVE-2009-1268: crash in Check Point High-Availability Protocol (CPHAP) dissector CVE-2009-1267: LDAP dissector could crash on Windows CVE-2009-1210: PROFINET format string bug CVE-2009-1266: additional PROFINET format string bugs, a crash in the PCNFSD dissector. (CVE-2009-1269)
    last seen2020-06-01
    modified2020-06-02
    plugin id41506
    published2009-09-24
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/41506
    titleSuSE 10 Security Update : ethereal (ZYPP Patch Number 6269)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_WIRESHARK-6271.NASL
    descriptionVersion upgrade to Wireshark 1.0.7 to fix various vulnerabilities: CVE-2009-1269: crash while loading a Tektronix .rf5 file CVE-2009-1268: crash in Check Point High-Availability Protocol (CPHAP) dissector CVE-2009-1267: LDAP dissector could crash on Windows CVE-2009-1210: PROFINET format string bug CVE-2009-1266: additional PROFINET format string bugs, a crash in the PCNFSD dissector
    last seen2020-06-01
    modified2020-06-02
    plugin id38924
    published2009-05-27
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/38924
    titleopenSUSE 10 Security Update : wireshark (wireshark-6271)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2009-1100.NASL
    descriptionUpdated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal. A format string flaw was found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-1210) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-1268, CVE-2009-1269, CVE-2009-1829) Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.8, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id39411
    published2009-06-16
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/39411
    titleRHEL 3 / 4 / 5 : wireshark (RHSA-2009:1100)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2009-1100.NASL
    descriptionUpdated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal. A format string flaw was found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-1210) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-1268, CVE-2009-1269, CVE-2009-1829) Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.8, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id39423
    published2009-06-17
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/39423
    titleCentOS 3 / 5 : wireshark (CESA-2009:1100)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2009-3599.NASL
    descriptionupgrade to wireshark-1.0.7 fixes various security flaws. http://www.wireshark.org/security/wnpa-sec-2009-02.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id38796
    published2009-05-18
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/38796
    titleFedora 10 : wireshark-1.0.7-1.fc10 (2009-3599)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_WIRESHARK-090525.NASL
    descriptionVersion upgrade to Wireshark 1.0.7 to fix various vulnerabilities : - crash while loading a Tektronix .rf5 file CVE-2009-1268: crash in Check Point High-Availability Protocol (CPHAP) dissector CVE-2009-1267: LDAP dissector could crash on Windows CVE-2009-1210: PROFINET format string bug CVE-2009-1266: additional PROFINET format string bugs, a crash in the PCNFSD dissector. (CVE-2009-1269)
    last seen2020-06-01
    modified2020-06-02
    plugin id41460
    published2009-09-24
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/41460
    titleSuSE 11 Security Update : wireshark (SAT Patch Number 910)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2009-5339.NASL
    descriptionUpgrade to 1.0.8 fixes various security flaws. http://www.wireshark.org/security/wnpa-sec-2009-02.html http://www.wireshark.org/security/wnpa-sec-2009-03.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id38904
    published2009-05-26
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/38904
    titleFedora 9 : wireshark-1.0.8-1.fc9 (2009-5339)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_DEFCE06839AA11DEA493001B77D09812.NASL
    descriptionWireshark team reports : Wireshark 1.0.7 fixes the following vulnerabilities : - The PROFINET dissector was vulnerable to a format string overflow. (Bug 3382) Versions affected: 0.99.6 to 1.0.6, CVE-2009-1210. - The Check Point High-Availability Protocol (CPHAP) dissector could crash. (Bug 3269) Versions affected: 0.9.6 to 1.0.6; CVE-2009-1268. - Wireshark could crash while loading a Tektronix .rf5 file. (Bug 3366) Versions affected: 0.99.6 to 1.0.6, CVE-2009-1269.
    last seen2020-06-01
    modified2020-06-02
    plugin id38728
    published2009-05-11
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/38728
    titleFreeBSD : wireshark -- multiple vulnerabilities (defce068-39aa-11de-a493-001b77d09812)

Oval

  • accepted2013-04-29T04:07:20.544-04:00
    classvulnerability
    contributors
    • nameAharon Chernin
      organizationSCAP.com, LLC
    • nameDragos Prisaca
      organizationG2, Inc.
    definition_extensions
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 3
      ovaloval:org.mitre.oval:def:11782
    • commentCentOS Linux 3.x
      ovaloval:org.mitre.oval:def:16651
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 4
      ovaloval:org.mitre.oval:def:11831
    • commentCentOS Linux 4.x
      ovaloval:org.mitre.oval:def:16636
    • commentOracle Linux 4.x
      ovaloval:org.mitre.oval:def:15990
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 5
      ovaloval:org.mitre.oval:def:11414
    • commentThe operating system installed on the system is CentOS Linux 5.x
      ovaloval:org.mitre.oval:def:15802
    • commentOracle Linux 5.x
      ovaloval:org.mitre.oval:def:15459
    descriptionUnspecified vulnerability in Wireshark 0.99.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted Tektronix .rf5 file.
    familyunix
    idoval:org.mitre.oval:def:10642
    statusaccepted
    submitted2010-07-09T03:56:16-04:00
    titleUnspecified vulnerability in Wireshark 0.99.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted Tektronix .rf5 file.
    version27
  • accepted2013-08-19T04:05:01.473-04:00
    classvulnerability
    contributors
    • nameChandan S
      organizationSecPod Technologies
    • nameShane Shaffer
      organizationG2, Inc.
    • nameShane Shaffer
      organizationG2, Inc.
    definition_extensions
    commentWireshark is installed on the system.
    ovaloval:org.mitre.oval:def:6589
    descriptionUnspecified vulnerability in Wireshark 0.99.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted Tektronix .rf5 file.
    familywindows
    idoval:org.mitre.oval:def:5748
    statusaccepted
    submitted2009-04-16T16:30:43
    titleWireshark Tektronix .rf5 Denial of Service Vulnerability
    version7

Redhat

advisories
rhsa
idRHSA-2009:1100
rpms
  • wireshark-0:1.0.8-1.el4_8.1
  • wireshark-0:1.0.8-1.el5_3.1
  • wireshark-0:1.0.8-EL3.1
  • wireshark-debuginfo-0:1.0.8-1.el4_8.1
  • wireshark-debuginfo-0:1.0.8-1.el5_3.1
  • wireshark-debuginfo-0:1.0.8-EL3.1
  • wireshark-gnome-0:1.0.8-1.el4_8.1
  • wireshark-gnome-0:1.0.8-1.el5_3.1
  • wireshark-gnome-0:1.0.8-EL3.1

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 34457 CVE(CAN) ID: CVE-2009-1267,CVE-2009-1268,CVE-2009-1269 Wireshark之前名为Ethereal,是一款非常流行的网络协议分析工具。 Wireshark的LDAP和CPHAP协议解析模块中存在拒绝服务漏洞。如果用户受骗从网络抓取了恶意的LDAP或CPHA FWHA_MY_STATE报文或读取了恶意抓包文件的话,就会导致解析模块崩溃。此外如果加载了恶意的Tektronix .rf5文件的话Wireshark可能会崩溃。 Wireshark 0.9.6 - 1.0.6 Wireshark --------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href=http://media-2.cacetech.com/wireshark/src/wireshark-1.0.7.tar.bz2 target=_blank rel=external nofollow>http://media-2.cacetech.com/wireshark/src/wireshark-1.0.7.tar.bz2</a>
idSSV:5036
last seen2017-11-19
modified2009-04-11
published2009-04-11
reporterRoot
titleWireshark 1.0.7版本修复多个拒绝服务漏洞