Vulnerabilities > CVE-2016-2522 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Wireshark 2.0.0/2.0.1
Attack vector
NETWORK Attack complexity
HIGH Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_45117749DF5511E5B2BD002590263BF5.NASL description Wireshark development team reports : The following vulnerabilities have been fixed : - wnpa-sec-2016-02 ASN.1 BER dissector crash. (Bug 11828) CVE-2016-2522 - wnpa-sec-2016-03 DNP dissector infinite loop. (Bug 11938) CVE-2016-2523 - wnpa-sec-2016-04 X.509AF dissector crash. (Bug 12002) CVE-2016-2524 - wnpa-sec-2016-05 HTTP/2 dissector crash. (Bug 12077) CVE-2016-2525 - wnpa-sec-2016-06 HiQnet dissector crash. (Bug 11983) CVE-2016-2526 - wnpa-sec-2016-07 3GPP TS 32.423 Trace file parser crash. (Bug 11982) CVE-2016-2527 - wnpa-sec-2016-08 LBMC dissector crash. (Bug 11984) CVE-2016-2528 - wnpa-sec-2016-09 iSeries file parser crash. (Bug 11985) CVE-2016-2529 - wnpa-sec-2016-10 RSL dissector crash. (Bug 11829) CVE-2016-2530 CVE-2016-2531 - wnpa-sec-2016-11 LLRP dissector crash. (Bug 12048) CVE-2016-2532 - wnpa-sec-2016-12 Ixia IxVeriWave file parser crash. (Bug 11795) - wnpa-sec-2016-13 IEEE 802.11 dissector crash. (Bug 11818) - wnpa-sec-2016-14 GSM A-bis OML dissector crash. (Bug 11825) - wnpa-sec-2016-15 ASN.1 BER dissector crash. (Bug 12106) - wnpa-sec-2016-16 SPICE dissector large loop. (Bug 12151) - wnpa-sec-2016-17 NFS dissector crash. - wnpa-sec-2016-18 ASN.1 BER dissector crash. (Bug 11822) last seen 2020-06-01 modified 2020-06-02 plugin id 89048 published 2016-03-01 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/89048 title FreeBSD : wireshark -- multiple vulnerabilities (45117749-df55-11e5-b2bd-002590263bf5) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201604-05.NASL description The remote host is affected by the vulnerability described in GLSA-201604-05 (Wireshark: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Wireshark. Please review the CVE identifiers referenced below for details. Impact : Remote attackers could cause Denial of Service and local attackers could escalate privileges. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 90744 published 2016-04-27 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/90744 title GLSA-201604-05 : Wireshark: Multiple vulnerabilities NASL family MacOS X Local Security Checks NASL id MACOSX_WIRESHARK_2_0_2.NASL description The version of Wireshark installed on the remote Mac OS X host is 2.0.x prior to 2.0.2. It is, therefore, affected by multiple vulnerabilities in the following components, which can result in a memory disclosure, a denial of service, or the execution of arbitrary code : - 3GPP TS 32.423 Trace file parser - ASN.1 BER dissector - DNP dissector - GSM A-bis OML dissector - HiQnet dissector - HTTP/2 dissector - IEEE 802.11 dissector - iSeries file parser - Ixia IxVeriWave file parser - LBMC dissector - LLRP dissector - NFS dissector - RSL dissector - SPICE dissector - X.509AF dissector Additionally, a flaw related to how dynamic-link library (DLL) files are located and loaded exists in the ui/qt/wireshark_application.cpp file due to the application using a DLL search path that may include directories that are not trusted or under the user last seen 2020-06-01 modified 2020-06-02 plugin id 89102 published 2016-03-03 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/89102 title Wireshark 2.0.x < 2.0.2 Multiple Vulnerabilities (Mac OS X) NASL family Windows NASL id WIRESHARK_2_0_2.NASL description The version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.2. It is, therefore, affected by multiple vulnerabilities in the following components, which can result in a memory disclosure, a denial of service, or the execution of arbitrary code : - 3GPP TS 32.423 Trace file parser - ASN.1 BER dissector - DNP dissector - GSM A-bis OML dissector - HiQnet dissector - HTTP/2 dissector - IEEE 802.11 dissector - iSeries file parser - Ixia IxVeriWave file parser - LBMC dissector - LLRP dissector - NFS dissector - RSL dissector - SPICE dissector - X.509AF dissector Additionally, a flaw related to how dynamic-link library (DLL) files are located and loaded exists in the ui/qt/wireshark_application.cpp file due to the application using a DLL search path that may include directories that are not trusted or under the user last seen 2020-06-01 modified 2020-06-02 plugin id 89104 published 2016-03-03 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/89104 title Wireshark 2.0.x < 2.0.2 Multiple Vulnerabilities
References
- http://www.wireshark.org/security/wnpa-sec-2016-02.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11828
- http://www.securitytracker.com/id/1035118
- https://security.gentoo.org/glsa/201604-05
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=9b2f3f7c5c9205381cb72e42b66e97d8ed3abf63