Vulnerabilities > CVE-2014-6424 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Wireshark

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN

Summary

The dissect_v9_v10_pdu_data function in epan/dissectors/packet-netflow.c in the Netflow dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 refers to incorrect offset and start variables, which allows remote attackers to cause a denial of service (uninitialized memory read and application crash) via a crafted packet.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2014-566.NASL
    descriptionWireshark was update to 1.10.10 [bnc#897055] On openSUSE 12.3, the package was upgraded to 1.10.x from 1.8.x as it was discontinued. This update fixes vulnerabilities in Wireshark that could allow an attacker to crash Wireshark or make it become unresponsive by sending specific packages onto the network or have it loaded via a capture file while the dissectors are running. It also contains a number of other bug fixes. - RTP dissector crash wnpa-sec-2014-12 CVE-2014-6421 CVE-2014-6422 - MEGACO dissector infinite loop wnpa-sec-2014-13 CVE-2014-6423 - Netflow dissector crash wnpa-sec-2014-14 CVE-2014-6424 - RTSP dissector crash wnpa-sec-2014-17 CVE-2014-6427 - SES dissector crash wnpa-sec-2014-18 CVE-2014-6428 - Sniffer file parser crash wnpa-sec-2014-19 CVE-2014-6429 CVE-2014-6430 CVE-2014-6431 CVE-2014-6432 - Further bug fixes as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.10.1 0.html - includes changes from 1.10.9: fixes several crashes triggered by malformed protocol packages - vulnerabilities fixed : - The Catapult DCT2000 and IrDA dissectors could underrun a buffer wnpa-sec-2014-08 CVE-2014-5161 CVE-2014-5162 (bnc#889901) - The GSM Management dissector could crash wnpa-sec-2014-09 CVE-2014-5163 (bnc#889906) - The RLC dissector could crash wnpa-sec-2014-10 CVE-2014-5164 (bnc#889900) - The ASN.1 BER dissector could crash wnpa-sec-2014-11 CVE-2014-5165 (bnc#889899) - Further bug fixes as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.10.9 .html
    last seen2020-06-05
    modified2014-10-02
    plugin id78021
    published2014-10-02
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/78021
    titleopenSUSE Security Update : wireshark (openSUSE-SU-2014:1249-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2014-566.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(78021);
      script_version("1.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2014-5161", "CVE-2014-5162", "CVE-2014-5163", "CVE-2014-5164", "CVE-2014-5165", "CVE-2014-6421", "CVE-2014-6422", "CVE-2014-6423", "CVE-2014-6424", "CVE-2014-6427", "CVE-2014-6428", "CVE-2014-6429", "CVE-2014-6430", "CVE-2014-6431", "CVE-2014-6432");
    
      script_name(english:"openSUSE Security Update : wireshark (openSUSE-SU-2014:1249-1)");
      script_summary(english:"Check for the openSUSE-2014-566 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Wireshark was update to 1.10.10 [bnc#897055]
    
    On openSUSE 12.3, the package was upgraded to 1.10.x from 1.8.x as it
    was discontinued.
    
    This update fixes vulnerabilities in Wireshark that could allow an
    attacker to crash Wireshark or make it become unresponsive by sending
    specific packages onto the network or have it loaded via a capture
    file while the dissectors are running. It also contains a number of
    other bug fixes.
    
      - RTP dissector crash wnpa-sec-2014-12 CVE-2014-6421
        CVE-2014-6422
    
      - MEGACO dissector infinite loop wnpa-sec-2014-13
        CVE-2014-6423
    
      - Netflow dissector crash wnpa-sec-2014-14 CVE-2014-6424
    
      - RTSP dissector crash wnpa-sec-2014-17 CVE-2014-6427
    
      - SES dissector crash wnpa-sec-2014-18 CVE-2014-6428
    
      - Sniffer file parser crash wnpa-sec-2014-19 CVE-2014-6429
        CVE-2014-6430 CVE-2014-6431 CVE-2014-6432
    
      - Further bug fixes as listed in:
        https://www.wireshark.org/docs/relnotes/wireshark-1.10.1
        0.html
    
      - includes changes from 1.10.9: fixes several crashes
        triggered by malformed protocol packages
    
      - vulnerabilities fixed :
    
      - The Catapult DCT2000 and IrDA dissectors could underrun
        a buffer wnpa-sec-2014-08 CVE-2014-5161 CVE-2014-5162
        (bnc#889901)
    
      - The GSM Management dissector could crash
        wnpa-sec-2014-09 CVE-2014-5163 (bnc#889906)
    
      - The RLC dissector could crash wnpa-sec-2014-10
        CVE-2014-5164 (bnc#889900)
    
      - The ASN.1 BER dissector could crash wnpa-sec-2014-11
        CVE-2014-5165 (bnc#889899)
    
      - Further bug fixes as listed in:
        https://www.wireshark.org/docs/relnotes/wireshark-1.10.9
        .html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=889899"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=889900"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=889901"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=889906"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=897055"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.wireshark.org/docs/relnotes/wireshark-1.10.10.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.wireshark.org/docs/relnotes/wireshark-1.10.9.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected wireshark packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wireshark");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wireshark-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wireshark-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:wireshark-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.3");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2014/09/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/10/02");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE12\.3|SUSE13\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.3 / 13.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE12.3", reference:"wireshark-1.10.10-1.44.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"wireshark-debuginfo-1.10.10-1.44.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"wireshark-debugsource-1.10.10-1.44.1") ) flag++;
    if ( rpm_check(release:"SUSE12.3", reference:"wireshark-devel-1.10.10-1.44.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"wireshark-1.10.10-24.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"wireshark-debuginfo-1.10.10-24.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"wireshark-debugsource-1.10.10-24.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"wireshark-devel-1.10.10-24.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "wireshark");
    }
    
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS11_WIRESHARK_20141120.NASL
    descriptionThe remote Solaris system is missing necessary patches to address security updates : - Use-after-free vulnerability in the SDP dissector in Wireshark 1.10.x before 1.10.10 allows remote attackers to cause a denial of service (application crash) via a crafted packet that leverages split memory ownership between the SDP and RTP dissectors. (CVE-2014-6421) - The SDP dissector in Wireshark 1.10.x before 1.10.10 creates duplicate hashtables for a media channel, which allows remote attackers to cause a denial of service (application crash) via a crafted packet to the RTP dissector. (CVE-2014-6422) - The tvb_raw_text_add function in epan/dissectors/packet-megaco.c in the MEGACO dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (infinite loop) via an empty line. (CVE-2014-6423) - The dissect_v9_v10_pdu_data function in epan/dissectors/packet-netflow.c in the Netflow dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 refers to incorrect offset and start variables, which allows remote attackers to cause a denial of service (uninitialized memory read and application crash) via a crafted packet. (CVE-2014-6424) - The (1) get_quoted_string and (2) get_unquoted_string functions in epan/ dissectors/packet-cups.c in the CUPS dissector in Wireshark 1.12.x before 1.12.1 allow remote attackers to cause a denial of service (buffer over-read and application crash) via a CUPS packet that lacks a trailing
    last seen2020-06-01
    modified2020-06-02
    plugin id80816
    published2015-01-19
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/80816
    titleOracle Solaris Third-Party Patch Update : wireshark (multiple_vulnerabilities_in_wireshark11)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from the Oracle Third Party software advisories.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(80816);
      script_version("1.2");
      script_cvs_date("Date: 2018/11/15 20:50:25");
    
      script_cve_id("CVE-2014-6421", "CVE-2014-6422", "CVE-2014-6423", "CVE-2014-6424", "CVE-2014-6425", "CVE-2014-6426", "CVE-2014-6427", "CVE-2014-6428", "CVE-2014-6429", "CVE-2014-6430", "CVE-2014-6431", "CVE-2014-6432");
    
      script_name(english:"Oracle Solaris Third-Party Patch Update : wireshark (multiple_vulnerabilities_in_wireshark11)");
      script_summary(english:"Check for the 'entire' version.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Solaris system is missing a security patch for third-party
    software."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote Solaris system is missing necessary patches to address
    security updates :
    
      - Use-after-free vulnerability in the SDP dissector in
        Wireshark 1.10.x before 1.10.10 allows remote attackers
        to cause a denial of service (application crash) via a
        crafted packet that leverages split memory ownership
        between the SDP and RTP dissectors. (CVE-2014-6421)
    
      - The SDP dissector in Wireshark 1.10.x before 1.10.10
        creates duplicate hashtables for a media channel, which
        allows remote attackers to cause a denial of service
        (application crash) via a crafted packet to the RTP
        dissector. (CVE-2014-6422)
    
      - The tvb_raw_text_add function in
        epan/dissectors/packet-megaco.c in the MEGACO dissector
        in Wireshark 1.10.x before 1.10.10 and 1.12.x before
        1.12.1 allows remote attackers to cause a denial of
        service (infinite loop) via an empty line.
        (CVE-2014-6423)
    
      - The dissect_v9_v10_pdu_data function in
        epan/dissectors/packet-netflow.c in the Netflow
        dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x
        before 1.12.1 refers to incorrect offset and start
        variables, which allows remote attackers to cause a
        denial of service (uninitialized memory read and
        application crash) via a crafted packet. (CVE-2014-6424)
    
      - The (1) get_quoted_string and (2) get_unquoted_string
        functions in epan/ dissectors/packet-cups.c in the CUPS
        dissector in Wireshark 1.12.x before 1.12.1 allow remote
        attackers to cause a denial of service (buffer over-read
        and application crash) via a CUPS packet that lacks a
        trailing '\0' character. (CVE-2014-6425)
    
      - The dissect_hip_tlv function in
        epan/dissectors/packet-hip.c in the HIP dissector in
        Wireshark 1.12.x before 1.12.1 does not properly handle
        a NULL tree, which allows remote attackers to cause a
        denial of service (infinite loop) via a crafted packet.
        (CVE-2014-6426)
    
      - Off-by-one error in the is_rtsp_request_or_reply
        function in epan/dissectors/ packet-rtsp.c in the RTSP
        dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x
        before 1.12.1 allows remote attackers to cause a denial
        of service (application crash) via a crafted packet that
        triggers parsing of a token located one position beyond
        the current position. (CVE-2014-6427)
    
      - The dissect_spdu function in
        epan/dissectors/packet-ses.c in the SES dissector in
        Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1
        does not initialize a certain ID value, which allows
        remote attackers to cause a denial of service
        (application crash) via a crafted packet.
        (CVE-2014-6428)
    
      - The SnifferDecompress function in wiretap/ngsniffer.c in
        the DOS Sniffer file parser in Wireshark 1.10.x before
        1.10.10 and 1.12.x before 1.12.1 does not properly
        handle empty input data, which allows remote attackers
        to cause a denial of service (application crash) via a
        crafted file. (CVE-2014-6429)
    
      - The SnifferDecompress function in wiretap/ngsniffer.c in
        the DOS Sniffer file parser in Wireshark 1.10.x before
        1.10.10 and 1.12.x before 1.12.1 does not validate
        bitmask data, which allows remote attackers to cause a
        denial of service (application crash) via a crafted
        file. (CVE-2014-6430)
    
      - Buffer overflow in the SnifferDecompress function in
        wiretap/ngsniffer.c in the DOS Sniffer file parser in
        Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1
        allows remote attackers to cause a denial of service
        (application crash) via a crafted file that triggers
        writes of uncompressed bytes beyond the end of the
        output buffer. (CVE-2014-6431)
    
      - The SnifferDecompress function in wiretap/ngsniffer.c in
        the DOS Sniffer file parser in Wireshark 1.10.x before
        1.10.10 and 1.12.x before 1.12.1 does not prevent data
        overwrites during copy operations, which allows remote
        attackers to cause a denial of service (application
        crash) via a crafted file. (CVE-2014-6432)"
      );
      # https://www.oracle.com/technetwork/topics/security/thirdparty-patch-map-1482893.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?4a913f44"
      );
      # https://blogs.oracle.com/sunsecurity/multiple-vulnerabilities-in-wireshark
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?6ccbc2d4"
      );
      script_set_attribute(attribute:"solution", value:"Upgrade to Solaris 11.2.4.6.0.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:solaris:11.2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:solaris:wireshark");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2014/11/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/19");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.");
      script_family(english:"Solaris Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Solaris11/release", "Host/Solaris11/pkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("solaris.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Solaris11/release");
    if (isnull(release)) audit(AUDIT_OS_NOT, "Solaris11");
    pkg_list = solaris_pkg_list_leaves();
    if (isnull (pkg_list)) audit(AUDIT_PACKAGE_LIST_MISSING, "Solaris pkg-list packages");
    
    if (empty_or_null(egrep(string:pkg_list, pattern:"^wireshark$"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "wireshark");
    
    flag = 0;
    
    if (solaris_check_release(release:"0.5.11-0.175.2.4.0.6.0", sru:"SRU 11.2.4.6.0") > 0) flag++;
    
    if (flag)
    {
      error_extra = 'Affected package : wireshark\n' + solaris_get_report2();
      error_extra = ereg_replace(pattern:"version", replace:"OS version", string:error_extra);
      if (report_verbosity > 0) security_warning(port:0, extra:error_extra);
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_PACKAGE_NOT_AFFECTED, "wireshark");
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_WIRESHARK-140923.NASL
    descriptionThe wireshark package was upgraded to 1.10.10 from 1.8.x as 1.8 was discontinued. This update fixes vulnerabilities that could allow an attacker to crash Wireshark or make it become unresponsive by sending specific packets onto the network or have them loaded via a capture file while the dissectors are running. It also contains a number of other bug fixes. - RTP dissector crash. (wnpa-sec-2014-12 CVE-2014-6421 / CVE-2014-6422) - MEGACO dissector infinite loop. (wnpa-sec-2014-13 CVE-2014-6423) - Netflow dissector crash. (wnpa-sec-2014-14 CVE-2014-6424) - RTSP dissector crash. (wnpa-sec-2014-17 CVE-2014-6427) - SES dissector crash. (wnpa-sec-2014-18 CVE-2014-6428) - Sniffer file parser crash. (wnpa-sec-2014-19 CVE-2014-6429 / CVE-2014-6430 / CVE-2014-6431 / CVE-2014-6432) - The Catapult DCT2000 and IrDA dissectors could underrun a buffer. (wnpa-sec-2014-08 CVE-2014-5161 / CVE-2014-5162, bnc#889901) - The GSM Management dissector could crash. (wnpa-sec-2014-09 CVE-2014-5163, bnc#889906) - The RLC dissector could crash. (wnpa-sec-2014-10 CVE-2014-5164, bnc#889900) - The ASN.1 BER dissector could crash. (wnpa-sec-2014-11 CVE-2014-5165, bnc#889899) Further bug fixes as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.10.1 0.html and https://www.wireshark.org/docs/relnotes/wireshark-1.10.9 .html .
    last seen2020-06-05
    modified2014-09-29
    plugin id77960
    published2014-09-29
    reporterThis script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/77960
    titleSuSE 11.3 Security Update : wireshark (SAT Patch Number 9745)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from SuSE 11 update information. The text itself is
    # copyright (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(77960);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2014-5161", "CVE-2014-5162", "CVE-2014-5163", "CVE-2014-5164", "CVE-2014-5165", "CVE-2014-6421", "CVE-2014-6422", "CVE-2014-6423", "CVE-2014-6424", "CVE-2014-6427", "CVE-2014-6428", "CVE-2014-6429", "CVE-2014-6430", "CVE-2014-6431", "CVE-2014-6432");
    
      script_name(english:"SuSE 11.3 Security Update : wireshark (SAT Patch Number 9745)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 11 host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The wireshark package was upgraded to 1.10.10 from 1.8.x as 1.8 was
    discontinued.
    
    This update fixes vulnerabilities that could allow an attacker to
    crash Wireshark or make it become unresponsive by sending specific
    packets onto the network or have them loaded via a capture file while
    the dissectors are running. It also contains a number of other bug
    fixes.
    
      - RTP dissector crash. (wnpa-sec-2014-12 CVE-2014-6421 /
        CVE-2014-6422)
    
      - MEGACO dissector infinite loop. (wnpa-sec-2014-13
        CVE-2014-6423)
    
      - Netflow dissector crash. (wnpa-sec-2014-14
        CVE-2014-6424)
    
      - RTSP dissector crash. (wnpa-sec-2014-17 CVE-2014-6427)
    
      - SES dissector crash. (wnpa-sec-2014-18 CVE-2014-6428)
    
      - Sniffer file parser crash. (wnpa-sec-2014-19
        CVE-2014-6429 / CVE-2014-6430 / CVE-2014-6431 /
        CVE-2014-6432)
    
      - The Catapult DCT2000 and IrDA dissectors could underrun
        a buffer. (wnpa-sec-2014-08 CVE-2014-5161 /
        CVE-2014-5162, bnc#889901)
    
      - The GSM Management dissector could crash.
        (wnpa-sec-2014-09 CVE-2014-5163, bnc#889906)
    
      - The RLC dissector could crash. (wnpa-sec-2014-10
        CVE-2014-5164, bnc#889900)
    
      - The ASN.1 BER dissector could crash. (wnpa-sec-2014-11
        CVE-2014-5165, bnc#889899) Further bug fixes as listed
        in:
        https://www.wireshark.org/docs/relnotes/wireshark-1.10.1
        0.html and
        https://www.wireshark.org/docs/relnotes/wireshark-1.10.9
        .html ."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=889854"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=889899"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=889900"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=889901"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=889906"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=897055"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-5161.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-5162.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-5163.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-5164.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-5165.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-6421.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-6422.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-6423.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-6424.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-6427.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-6428.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-6429.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-6430.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-6431.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2014-6432.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply SAT patch number 9745.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:wireshark");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2014/09/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/09/29");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);
    
    pl = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(pl) || int(pl) != 3) audit(AUDIT_OS_NOT, "SuSE 11.3");
    
    
    flag = 0;
    if (rpm_check(release:"SLED11", sp:3, cpu:"i586", reference:"wireshark-1.10.10-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:3, cpu:"x86_64", reference:"wireshark-1.10.10-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:3, reference:"wireshark-1.10.10-0.2.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyWindows
    NASL idWIRESHARK_1_12_1.NASL
    descriptionThe installed version of Wireshark is version 1.12.x prior to 1.12.1. It is, therefore, affected by the following vulnerabilities : - Errors exist in the following dissectors that can cause the application to crash : - CUPS (CVE-2014-6425) - HIP (CVE-2014-6426) - MEGACO (CVE-2014-6423) - Netflow (CVE-2014-6424) - RTSP (CVE-2014-6427) - SES (CVE-2014-6428) - Unspecified errors exist related to file parsing that can cause the parser to crash. (CVE-2014-6429, CVE-2014-6430, CVE-2014-6431, CVE-2014-6432) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id77732
    published2014-09-17
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/77732
    titleWireshark 1.12.x < 1.12.1 Multiple DoS Vulnerabilities
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201412-52.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201412-52 (Wireshark: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Wireshark. Please review the CVE identifiers referenced below for details. Impact : A remote attacker can cause a Denial of Service condition via specially crafted packets. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id80273
    published2014-12-29
    reporterThis script is Copyright (C) 2014-2015 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/80273
    titleGLSA-201412-52 : Wireshark: Multiple vulnerabilities
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2014-446.NASL
    descriptionMultiple flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2014-6429 , CVE-2014-6430 , CVE-2014-6431 , CVE-2014-6432) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2014-6421 , CVE-2014-6422 , CVE-2014-6423 , CVE-2014-6424 , CVE-2014-6425 , CVE-2014-6426 , CVE-2014-6427 , CVE-2014-6428)
    last seen2020-06-01
    modified2020-06-02
    plugin id79295
    published2014-11-18
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/79295
    titleAmazon Linux AMI : wireshark (ALAS-2014-446)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3049.NASL
    descriptionMultiple vulnerabilities were discovered in the dissectors/parsers for RTP, MEGACO, Netflow, RTSP, SES and Sniffer, which could result in denial of service.
    last seen2020-03-17
    modified2014-10-15
    plugin id78449
    published2014-10-15
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/78449
    titleDebian DSA-3049-1 : wireshark - security update
  • NASL familyWindows
    NASL idWIRESHARK_1_10_10.NASL
    descriptionThe installed version of Wireshark is version 1.10.x prior to 1.10.10. It is, therefore, affected by the following vulnerabilities : - Errors exist in the following dissectors that can cause the application to crash : - MEGACO (CVE-2014-6423) - Netflow (CVE-2014-6424) - RTP (CVE-2014-6421, CVE-2014-6422) - RTSP (CVE-2014-6427) - SES (CVE-2014-6428) - Unspecified errors exist related to file parsing that can cause the parser to crash. (CVE-2014-6429, CVE-2014-6430, CVE-2014-6431, CVE-2014-6432) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id77731
    published2014-09-17
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/77731
    titleWireshark 1.10.x < 1.10.10 Multiple DoS Vulnerabilities
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2014-11441.NASL
    descriptionVer. 1.10.10, Security fix for CVE-2014-6430, CVE-2014-6423, CVE-2014-6424, CVE-2014-6432, CVE-2014-6431, CVE-2014-6427, CVE-2014-6428, CVE-2014-6429, CVE-2014-6421, CVE-2014-6422 fix decode Camellia encryption for Kerberos 5 fix decode elliptic curves in DTLS Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2014-09-26
    plugin id77875
    published2014-09-26
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/77875
    titleFedora 20 : wireshark-1.10.10-1.fc20 (2014-11441)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20141021_WIRESHARK_ON_SL6_X.NASL
    descriptionMultiple flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2014-6429, CVE-2014-6430, CVE-2014-6431, CVE-2014-6432) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2014-6421, CVE-2014-6422, CVE-2014-6423, CVE-2014-6424, CVE-2014-6425, CVE-2014-6426, CVE-2014-6427, CVE-2014-6428) All running instances of Wireshark must be restarted for the update to take effect.
    last seen2020-03-18
    modified2014-10-23
    plugin id78649
    published2014-10-23
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/78649
    titleScientific Linux Security Update : wireshark on SL6.x, SL7.x i386/x86_64 (20141021)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2014-188.NASL
    descriptionUpdated wireshark packages fix security vulnerabilities : RTP dissector crash (CVE-2014-6421, CVE-2014-6422). MEGACO dissector infinite loop (CVE-2014-6423). Netflow dissector crash (CVE-2014-6424). RTSP dissector crash (CVE-2014-6427). SES dissector crash (CVE-2014-6428). Sniffer file parser crash (CVE-2014-6429, CVE-2014-6430, CVE-2014-6431, CVE-2014-6432).
    last seen2020-06-01
    modified2020-06-02
    plugin id77888
    published2014-09-26
    reporterThis script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/77888
    titleMandriva Linux Security Advisory : wireshark (MDVSA-2014:188)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2014-1676.NASL
    descriptionFrom Red Hat Security Advisory 2014:1676 : Updated wireshark packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Wireshark is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network. Multiple flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2014-6429, CVE-2014-6430, CVE-2014-6431, CVE-2014-6432) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2014-6421, CVE-2014-6422, CVE-2014-6423, CVE-2014-6424, CVE-2014-6425, CVE-2014-6426, CVE-2014-6427, CVE-2014-6428) All wireshark users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id78619
    published2014-10-22
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/78619
    titleOracle Linux 6 / 7 : wireshark (ELSA-2014-1676)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2014-12362.NASL
    descriptionVer. 1.12.1 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2014-10-12
    plugin id78381
    published2014-10-12
    reporterThis script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/78381
    titleFedora 21 : wireshark-1.12.1-1.fc21 (2014-12362)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2014-1676.NASL
    descriptionUpdated wireshark packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Wireshark is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network. Multiple flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2014-6429, CVE-2014-6430, CVE-2014-6431, CVE-2014-6432) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2014-6421, CVE-2014-6422, CVE-2014-6423, CVE-2014-6424, CVE-2014-6425, CVE-2014-6426, CVE-2014-6427, CVE-2014-6428) All wireshark users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id78620
    published2014-10-22
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/78620
    titleRHEL 6 / 7 : wireshark (RHSA-2014:1676)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2014-1676.NASL
    descriptionUpdated wireshark packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Wireshark is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network. Multiple flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2014-6429, CVE-2014-6430, CVE-2014-6431, CVE-2014-6432) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2014-6421, CVE-2014-6422, CVE-2014-6423, CVE-2014-6424, CVE-2014-6425, CVE-2014-6426, CVE-2014-6427, CVE-2014-6428) All wireshark users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id78608
    published2014-10-22
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/78608
    titleCentOS 6 / 7 : wireshark (CESA-2014:1676)

Redhat

advisories
rhsa
idRHSA-2014:1676
rpms
  • wireshark-0:1.10.3-12.el7_0
  • wireshark-0:1.8.10-8.el6_6
  • wireshark-debuginfo-0:1.10.3-12.el7_0
  • wireshark-debuginfo-0:1.8.10-8.el6_6
  • wireshark-devel-0:1.10.3-12.el7_0
  • wireshark-devel-0:1.8.10-8.el6_6
  • wireshark-gnome-0:1.10.3-12.el7_0
  • wireshark-gnome-0:1.8.10-8.el6_6