Vulnerabilities > CVE-2009-2560 - Multiple vulnerability in Wireshark 1.2.0

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
wireshark
nessus

Summary

Multiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace and is processed by the (1) Bluetooth L2CAP, (2) RADIUS, or (3) MIOP dissector. NOTE: it was later reported that the RADIUS issue also affects 0.10.13 through 1.0.9.

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200911-05.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200911-05 (Wireshark: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Wireshark: Ryan Giobbi reported an integer overflow in wiretap/erf.c (CVE-2009-3829). The vendor reported multiple unspecified vulnerabilities in the Bluetooth L2CAP, RADIUS, and MIOP dissectors (CVE-2009-2560), in the OpcUa dissector (CVE-2009-3241), in packet.c in the GSM A RR dissector (CVE-2009-3242), in the TLS dissector (CVE-2009-3243), in the Paltalk dissector (CVE-2009-3549), in the DCERPC/NT dissector (CVE-2009-3550), and in the dissect_negprot_response() function in packet-smb.c in the SMB dissector (CVE-2009-3551). Impact : A remote attacker could entice a user to open a specially crafted
    last seen2020-06-01
    modified2020-06-02
    plugin id42915
    published2009-11-30
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42915
    titleGLSA-200911-05 : Wireshark: Multiple vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 200911-05.
    #
    # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(42915);
      script_version("1.15");
      script_cvs_date("Date: 2019/08/02 13:32:45");
    
      script_cve_id("CVE-2009-2560", "CVE-2009-3241", "CVE-2009-3242", "CVE-2009-3243", "CVE-2009-3549", "CVE-2009-3550", "CVE-2009-3551", "CVE-2009-3829");
      script_bugtraq_id(35748, 36408, 36591, 36846);
      script_xref(name:"GLSA", value:"200911-05");
    
      script_name(english:"GLSA-200911-05 : Wireshark: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-200911-05
    (Wireshark: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in Wireshark:
        Ryan Giobbi reported an integer overflow in wiretap/erf.c
        (CVE-2009-3829).
        The vendor reported multiple unspecified
        vulnerabilities in the Bluetooth L2CAP, RADIUS, and MIOP dissectors
        (CVE-2009-2560), in the OpcUa dissector (CVE-2009-3241), in packet.c in
        the GSM A RR dissector (CVE-2009-3242), in the TLS dissector
        (CVE-2009-3243), in the Paltalk dissector (CVE-2009-3549), in the
        DCERPC/NT dissector (CVE-2009-3550), and in the
        dissect_negprot_response() function in packet-smb.c in the SMB
        dissector (CVE-2009-3551).
      
    Impact :
    
        A remote attacker could entice a user to open a specially crafted 'erf'
        file using Wireshark, possibly resulting in the execution of arbitrary
        code with the privileges of the user running the application. A remote
        attacker could furthermore send specially crafted packets on a network
        being monitored by Wireshark or entice a user to open a malformed
        packet trace file using Wireshark, possibly resulting in a Denial of
        Service.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200911-05"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Wireshark users should upgrade to the latest version:
        # emerge --sync
        # emerge --ask --oneshot --verbose '>=net-analyzer/wireshark-1.2.3'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(20, 189);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:wireshark");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/11/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/11/30");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"net-analyzer/wireshark", unaffected:make_list("ge 1.2.3"), vulnerable:make_list("lt 1.2.3"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Wireshark");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_WIRESHARK-091125.NASL
    descriptionVersion upgrade of wireshark fix multiple vulnerabilities : - CVE-2009-3549: CVSS v2 Base Score: 5.0 (MEDIUM) The Paltalk dissector could crash on alignment-sensitive processors. - CVE-2009-3550: CVSS v2 Base Score: 4.3 (MEDIUM) The DCERPC/NT dissector could crash. - CVE-2009-3551: CVSS v2 Base Score: 5.0 (MEDIUM) The SMB dissector could crash. - CVE-2009-2560: CVSS v2 Base Score: 5.0 (MEDIUM) The RADIUS dissector could crash. - CVE-2009-3829 CVSS v2 Base Score: 9.3 (HIGH) Fix for an integer overflow in wiretap/erf.c that allowed remote attackers to execute arbitrary code via a crafted ERF file. This does not affect SLE products.
    last seen2020-06-01
    modified2020-06-02
    plugin id42950
    published2009-12-01
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42950
    titleopenSUSE Security Update : wireshark (wireshark-1600)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update wireshark-1600.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(42950);
      script_version("1.9");
      script_cvs_date("Date: 2019/10/25 13:36:34");
    
      script_cve_id("CVE-2009-2560", "CVE-2009-3549", "CVE-2009-3550", "CVE-2009-3551", "CVE-2009-3829");
    
      script_name(english:"openSUSE Security Update : wireshark (wireshark-1600)");
      script_summary(english:"Check for the wireshark-1600 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Version upgrade of wireshark fix multiple vulnerabilities :
    
      - CVE-2009-3549: CVSS v2 Base Score: 5.0 (MEDIUM) The
        Paltalk dissector could crash on alignment-sensitive
        processors.
    
      - CVE-2009-3550: CVSS v2 Base Score: 4.3 (MEDIUM) The
        DCERPC/NT dissector could crash.
    
      - CVE-2009-3551: CVSS v2 Base Score: 5.0 (MEDIUM) The SMB
        dissector could crash.
    
      - CVE-2009-2560: CVSS v2 Base Score: 5.0 (MEDIUM) The
        RADIUS dissector could crash.
    
      - CVE-2009-3829 CVSS v2 Base Score: 9.3 (HIGH) Fix for an
        integer overflow in wiretap/erf.c that allowed remote
        attackers to execute arbitrary code via a crafted ERF
        file. This does not affect SLE products."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=550320"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=553215"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected wireshark packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_cwe_id(20, 189);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wireshark");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wireshark-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/11/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/12/01");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE11\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.0", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE11.0", reference:"wireshark-1.0.0-17.19") ) flag++;
    if ( rpm_check(release:"SUSE11.0", reference:"wireshark-devel-1.0.0-17.19") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "wireshark / wireshark-devel");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2009-7998.NASL
    descriptionRebased to 1.2.x, fixing several security flaws, see the security advisory for details: http://www.wireshark.org/security/wnpa-sec-2009-04.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id43015
    published2009-12-07
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/43015
    titleFedora 10 : wireshark-1.2.1-1.fc10 (2009-7998)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_2_WIRESHARK-091125.NASL
    descriptionVersion upgrade of wireshark fix multiple vulnerabilities : - CVE-2009-3549: CVSS v2 Base Score: 5.0 (MEDIUM) The Paltalk dissector could crash on alignment-sensitive processors. - CVE-2009-3550: CVSS v2 Base Score: 4.3 (MEDIUM) The DCERPC/NT dissector could crash. - CVE-2009-3551: CVSS v2 Base Score: 5.0 (MEDIUM) The SMB dissector could crash. - CVE-2009-2560: CVSS v2 Base Score: 5.0 (MEDIUM) The RADIUS dissector could crash. - CVE-2009-3829 CVSS v2 Base Score: 9.3 (HIGH) Fix for an integer overflow in wiretap/erf.c that allowed remote attackers to execute arbitrary code via a crafted ERF file. This does not affect SLE products.
    last seen2020-06-01
    modified2020-06-02
    plugin id42955
    published2009-12-01
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42955
    titleopenSUSE Security Update : wireshark (wireshark-1600)
  • NASL familySuSE Local Security Checks
    NASL idSUSE9_12530.NASL
    descriptionThis is an update of wireshark to fix multiple vulnerabilities : - CVSS v2 Base Score: 5.0 (MEDIUM) The Paltalk dissector could crash on alignment-sensitive processors. (CVE-2009-3549) - CVSS v2 Base Score: 4.3 (MEDIUM) The DCERPC/NT dissector could crash. (CVE-2009-3550) - CVSS v2 Base Score: 5.0 (MEDIUM) The SMB dissector could crash. (CVE-2009-3551) - CVSS v2 Base Score: 5.0 (MEDIUM) The RADIUS dissector could crash. (CVE-2009-2560)
    last seen2020-06-01
    modified2020-06-02
    plugin id42947
    published2009-12-01
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42947
    titleSuSE9 Security Update : ethereal (YOU Patch Number 12530)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_ETHEREAL-6627.NASL
    descriptionUpdate of wireshark to fix multiple vulnerabilities : - The Paltalk dissector could crash on alignment-sensitive processors. (CVE-2009-3549: CVSS v2 Base Score: 5.0 (MEDIUM)) - The DCERPC/NT dissector could crash. (CVE-2009-3550: CVSS v2 Base Score: 4.3 (MEDIUM)) - The SMB dissector could crash. (CVE-2009-3551: CVSS v2 Base Score: 5.0 (MEDIUM)) - The RADIUS dissector could crash. (CVE-2009-2560: CVSS v2 Base Score: 5.0 (MEDIUM))
    last seen2020-06-01
    modified2020-06-02
    plugin id42958
    published2009-12-01
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42958
    titleSuSE 10 Security Update : ethereal (ZYPP Patch Number 6627)
  • NASL familyWindows
    NASL idWIRESHARK_1_2_1.NASL
    descriptionThe installed version of Wireshark or Ethereal is affected by multiple issues : - The IPMI dissector could overrun a buffer. (Bug 3559) - The AFS dissector could crash. (Bug 3564) - The Infiniband dissector could crash on some platforms. - The Bluetooth L2CAP dissector could crash. (Bug 3572) - The RADIUS dissector could crash. (Bug 3578) - The MIOP dissector could crash. (Bug 3652) - The sFlow dissector could use excessive CPU and memory. (Bug 3570) These vulnerabilities could result in a denial of service, or possibly arbitrary code execution. A remote attacker could exploit these issues by tricking a user into opening a maliciously crafted capture file. Additionally, if Wireshark is running in promiscuous mode, one of these issues could be exploited remotely (from the same network segment).
    last seen2020-06-01
    modified2020-06-02
    plugin id40335
    published2009-07-21
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40335
    titleWireshark / Ethereal 0.9.2 to 1.2.0 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_WIRESHARK-091125.NASL
    descriptionVersion upgrade of wireshark fix multiple vulnerabilities : - CVE-2009-3549: CVSS v2 Base Score: 5.0 (MEDIUM) The Paltalk dissector could crash on alignment-sensitive processors. - CVE-2009-3550: CVSS v2 Base Score: 4.3 (MEDIUM) The DCERPC/NT dissector could crash. - CVE-2009-3551: CVSS v2 Base Score: 5.0 (MEDIUM) The SMB dissector could crash. - CVE-2009-2560: CVSS v2 Base Score: 5.0 (MEDIUM) The RADIUS dissector could crash. - CVE-2009-3829 CVSS v2 Base Score: 9.3 (HIGH) Fix for an integer overflow in wiretap/erf.c that allowed remote attackers to execute arbitrary code via a crafted ERF file. This does not affect SLE products.
    last seen2020-06-01
    modified2020-06-02
    plugin id42953
    published2009-12-01
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42953
    titleopenSUSE Security Update : wireshark (wireshark-1600)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_ETHEREAL-6628.NASL
    descriptionUpdate of wireshark to fix multiple vulnerabilities : - The Paltalk dissector could crash on alignment-sensitive processors. (CVE-2009-3549: CVSS v2 Base Score: 5.0 (MEDIUM)) - The DCERPC/NT dissector could crash. (CVE-2009-3550: CVSS v2 Base Score: 4.3 (MEDIUM)) - The SMB dissector could crash. (CVE-2009-3551: CVSS v2 Base Score: 5.0 (MEDIUM)) - The RADIUS dissector could crash. (CVE-2009-2560: CVSS v2 Base Score: 5.0 (MEDIUM))
    last seen2020-06-01
    modified2020-06-02
    plugin id49845
    published2010-10-11
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49845
    titleSuSE 10 Security Update : ethereal (ZYPP Patch Number 6628)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_WIRESHARK-091125.NASL
    descriptionVersion upgrade of wireshark fix multiple vulnerabilities : - The Paltalk dissector could crash on alignment-sensitive processors. (CVE-2009-3549: CVSS v2 Base Score: 5.0 (MEDIUM)) - The DCERPC/NT dissector could crash. (CVE-2009-3550: CVSS v2 Base Score: 4.3 (MEDIUM)) - The SMB dissector could crash. (CVE-2009-3551: CVSS v2 Base Score: 5.0 (MEDIUM)) - The RADIUS dissector could crash. (CVE-2009-2560: CVSS v2 Base Score: 5.0 (MEDIUM)) - Fix for an integer overflow in wiretap/erf.c that allowed remote attackers to execute arbitrary code via a crafted ERF file. (CVE-2009-3829). (CVSS v2 Base Score: 9.3 (HIGH))
    last seen2020-06-01
    modified2020-06-02
    plugin id43085
    published2009-12-09
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/43085
    titleSuSE 11 Security Update : wireshark (SAT Patch Number 1606)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2010-0360.NASL
    descriptionUpdated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal. An invalid pointer dereference flaw was found in the Wireshark SMB and SMB2 dissectors. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-4377) Several buffer overflow flaws were found in the Wireshark LWRES dissector. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2010-0304) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-2560, CVE-2009-2562, CVE-2009-2563, CVE-2009-3550, CVE-2009-3829) Users of Wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.11, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id46301
    published2010-05-11
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/46301
    titleRHEL 3 / 4 / 5 : wireshark (RHSA-2010:0360)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2010-0360.NASL
    descriptionFrom Red Hat Security Advisory 2010:0360 : Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal. An invalid pointer dereference flaw was found in the Wireshark SMB and SMB2 dissectors. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-4377) Several buffer overflow flaws were found in the Wireshark LWRES dissector. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2010-0304) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-2560, CVE-2009-2562, CVE-2009-2563, CVE-2009-3550, CVE-2009-3829) Users of Wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.11, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id68032
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68032
    titleOracle Linux 3 / 4 / 5 : wireshark (ELSA-2010-0360)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1942.NASL
    descriptionSeveral remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2560 A NULL pointer dereference was found in the RADIUS dissector. - CVE-2009-3550 A NULL pointer dereference was found in the DCERP/NT dissector. - CVE-2009-3829 An integer overflow was discovered in the ERF parser. This update also includes fixes for three minor issues (CVE-2008-1829, CVE-2009-2562, CVE-2009-3241 ), which were scheduled for the next stable point update. Also CVE-2009-1268 was fixed for Etch. Since this security update was issued prior to the release of the point update, the fixes were included.
    last seen2020-06-01
    modified2020-06-02
    plugin id44807
    published2010-02-24
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44807
    titleDebian DSA-1942-1 : wireshark - several vulnerabilities
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2009-194.NASL
    descriptionVulnerabilities have been discovered in wireshark package, which could lead to application crash via radius, infiniband and afs dissectors (CVE-2009-2560, CVE-2009-2562, CVE-2009-2563). This update provides a fix for those vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id40498
    published2009-08-06
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40498
    titleMandriva Linux Security Advisory : wireshark (MDVSA-2009:194)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2010-0360.NASL
    descriptionUpdated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal. An invalid pointer dereference flaw was found in the Wireshark SMB and SMB2 dissectors. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-4377) Several buffer overflow flaws were found in the Wireshark LWRES dissector. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2010-0304) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-2560, CVE-2009-2562, CVE-2009-2563, CVE-2009-3550, CVE-2009-3829) Users of Wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.11, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id45594
    published2010-04-22
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/45594
    titleCentOS 3 / 4 / 5 : wireshark (CESA-2010:0360)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200909-16.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200909-16 (Wireshark: Denial of Service) Multiple vulnerabilities were discovered in Wireshark: A buffer overflow in the IPMI dissector related to an array index error (CVE-2009-2559). Multiple unspecified vulnerabilities in the Bluetooth L2CAP, RADIUS, and MIOP dissectors (CVE-2009-2560). An unspecified vulnerability in the sFlow dissector (CVE-2009-2561). An unspecified vulnerability in the AFS dissector (CVE-2009-2562). An unspecified vulnerability in the Infiniband dissector when running on unspecified platforms (CVE-2009-2563). Impact : A remote attacker could exploit these vulnerabilities by sending specially crafted packets on a network being monitored by Wireshark or by enticing a user to read a malformed packet trace file to cause a Denial of Service. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id40963
    published2009-09-14
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40963
    titleGLSA-200909-16 : Wireshark: Denial of Service
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2009-9837.NASL
    descriptionUpdate to Wireshark 1.2.2 fixing multiple security issues: http://www.wireshark.org/docs/relnotes/wireshark-1.2.2.html http://www.wireshark.org/security/wnpa-sec-2009-06.html * The OpcUa dissector could use excessive CPU and memory. (Bug 3986) Versions affected: 0.99.6 to 1.0.8, 1.2.0 to 1.2.1 * The GSM A RR dissector could crash. (Bug 3893) Versions affected: 1.2.0 to 1.2.1 * The TLS dissector could crash on some platforms. (Bug 4008) Versions affected: 1.2.0 to 1.2.1 http://www.wireshark.org/docs/relnotes/wireshark-1.2.1.html http://www.wireshark.org/security/wnpa-sec-2009-04.html * The AFS dissector could crash. (Bug 3564) Versions affected: 0.9.2 to 1.2.0 - The Infiniband dissector could crash on some platforms. Versions affected: 1.0.6 to 1.2.0 * The IPMI dissector could overrun a buffer. (Bug 3559) Versions affected: 1.2.0 * The Bluetooth L2CAP dissector could crash. (Bug 3572) Versions affected: 1.2.0 * The RADIUS dissector could crash. (Bug 3578) Versions affected: 1.2.0 * The MIOP dissector could crash. (Bug 3652) Versions affected: 1.2.0 * The sFlow dissector could use excessive CPU and memory. (Bug 3570) Versions affected: 1.2.0 (Issues from wnpa-sec-2009-04 does not affect users of Wireshark 1.2.1 packages from updates-testing.) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id42387
    published2009-11-05
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/42387
    titleFedora 11 : wireshark-1.2.2-1.fc11 (2009-9837)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20100420_WIRESHARK_ON_SL3_X.NASL
    descriptionAn invalid pointer dereference flaw was found in the Wireshark SMB and SMB2 dissectors. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-4377) Several buffer overflow flaws were found in the Wireshark LWRES dissector. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2010-0304) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-2560, CVE-2009-2562, CVE-2009-2563, CVE-2009-3550, CVE-2009-3829) All running instances of Wireshark must be restarted for the update to take effect. Note: libsmi was added to SL4 and SL5 because it was a new dependency for wireshark and older versions of SL4 and SL5 did not have libsmi.
    last seen2020-06-01
    modified2020-06-02
    plugin id60785
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60785
    titleScientific Linux Security Update : wireshark on SL3.x, SL4.x, SL5.x i386/x86_64

Oval

  • accepted2013-04-29T04:05:21.965-04:00
    classvulnerability
    contributors
    • nameAharon Chernin
      organizationSCAP.com, LLC
    • nameDragos Prisaca
      organizationG2, Inc.
    definition_extensions
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 3
      ovaloval:org.mitre.oval:def:11782
    • commentCentOS Linux 3.x
      ovaloval:org.mitre.oval:def:16651
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 4
      ovaloval:org.mitre.oval:def:11831
    • commentCentOS Linux 4.x
      ovaloval:org.mitre.oval:def:16636
    • commentOracle Linux 4.x
      ovaloval:org.mitre.oval:def:15990
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 5
      ovaloval:org.mitre.oval:def:11414
    • commentThe operating system installed on the system is CentOS Linux 5.x
      ovaloval:org.mitre.oval:def:15802
    • commentOracle Linux 5.x
      ovaloval:org.mitre.oval:def:15459
    descriptionMultiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace and is processed by the (1) Bluetooth L2CAP, (2) RADIUS, or (3) MIOP dissector. NOTE: it was later reported that the RADIUS issue also affects 0.10.13 through 1.0.9.
    familyunix
    idoval:org.mitre.oval:def:10403
    statusaccepted
    submitted2010-07-09T03:56:16-04:00
    titleMultiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace and is processed by the (1) Bluetooth L2CAP, (2) RADIUS, or (3) MIOP dissector. NOTE: it was later reported that the RADIUS issue also affects 0.10.13 through 1.0.9.
    version27
  • accepted2013-08-19T04:05:09.431-04:00
    classvulnerability
    contributors
    • namePrabhu.S.A
      organizationSecPod Technologies
    • nameShane Shaffer
      organizationG2, Inc.
    • nameShane Shaffer
      organizationG2, Inc.
    definition_extensions
    commentWireshark is installed on the system.
    ovaloval:org.mitre.oval:def:6589
    descriptionMultiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace and is processed by the (1) Bluetooth L2CAP, (2) RADIUS, or (3) MIOP dissector. NOTE: it was later reported that the RADIUS issue also affects 0.10.13 through 1.0.9.
    familywindows
    idoval:org.mitre.oval:def:6416
    statusaccepted
    submitted2009-09-24T15:11:12
    titleMultiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause DOS.
    version7

Redhat

rpms
  • wireshark-0:1.0.11-1.el4_8.5
  • wireshark-0:1.0.11-1.el5_5.5
  • wireshark-0:1.0.11-EL3.6
  • wireshark-debuginfo-0:1.0.11-1.el4_8.5
  • wireshark-debuginfo-0:1.0.11-1.el5_5.5
  • wireshark-debuginfo-0:1.0.11-EL3.6
  • wireshark-gnome-0:1.0.11-1.el4_8.5
  • wireshark-gnome-0:1.0.11-1.el5_5.5
  • wireshark-gnome-0:1.0.11-EL3.6

Seebug

  • bulletinFamilyexploit
    descriptionBUGTRAQ ID: 36846 CVE(CAN) ID: CVE-2009-3551,CVE-2009-3549,CVE-2009-3550,CVE-2009-2560 Wireshark之前名为Ethereal,是一款非常流行的网络协议分析工具。 Wireshark的Paltalk、DCERPC/NT、SMB和RADIUS协议解析模块中存在拒绝服务漏洞。如果用户受骗从网络抓取了恶意的报文或读取了恶意抓包文件的话,就会导致解析模块崩溃。 1) Paltalk协议解析模块epan/dissectors/packet-paltalk.c文件中的dissect_paltalk()函数存在对齐错误,在区分对齐的架构上可能导致崩溃。 2) DCERPC/NT协议解析模块中存在空指针引用。 3) SMB协议解析模块的epan/dissectors/packet-smb.c文件中的dissect_negprot_response()函数存在单字节溢出错误,可能导致崩溃。 4) RADIUS协议解析模块中的错误可能导致崩溃。 Wireshark 0.10.10 - 1.2.2 临时解决方法: * 禁用受影响的解析模块: 1 从菜单选择Analyze→Enabled Protocols... 2 清除Paltalk、DCERPC、SMB和RADIUS 3 点击“保存”、“确定” 厂商补丁: Wireshark --------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: http://www.wireshark.org/
    idSSV:12547
    last seen2017-11-19
    modified2009-10-30
    published2009-10-30
    reporterRoot
    titleWireshark 1.2.2和1.0.9版本修复多个拒绝服务漏洞
  • bulletinFamilyexploit
    descriptionNo description provided by source.
    idSSV:14981
    last seen2017-11-19
    modified2009-11-26
    published2009-11-26
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-14981
    titleWireshark: Multiple vulnerabilities

Statements

contributorTomas Hoger
lastmodified2010-04-20
organizationRed Hat
statementThe affected version of Wireshark as shipped in Red Hat Enterprise Linux 3, 4, and 5 were fixed via: https://rhn.redhat.com/errata/RHSA-2010-0360.html Vectors (1) Bluetooth L2CAP and (3) MIOP did not affect the versions of the Wireshark package, as shipped with Red Hat Enterprise Linux 3, 4, or 5.