Vulnerabilities > CVE-2016-4084 - Unspecified vulnerability in Wireshark 2.0.0/2.0.1/2.0.2

047910
CVSS 5.9 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
high complexity
wireshark
nessus

Summary

Integer signedness error in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.3 allows remote attackers to cause a denial of service (integer overflow and application crash) via a crafted packet that triggers an unexpected array size.

Vulnerable Configurations

Part Description Count
Application
Wireshark
3

Nessus

  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_WIRESHARK_2_0_3.NASL
    descriptionThe version of Wireshark installed on the remote Mac OS X host is 2.0.x prior to 2.0.3. It is, therefore, affected by multiple denial of service vulnerabilities in the following components : - GSM CBCH dissector - IAX2 dissector - IEEE 802.11 dissector - MS-WSP dissector - NCP dissector - PKTC dissector - TShark
    last seen2020-06-01
    modified2020-06-02
    plugin id90785
    published2016-04-29
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90785
    titleWireshark 2.0.x < 2.0.3 Multiple DoS (Mac OS X)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(90785);
      script_version("1.7");
      script_cvs_date("Date: 2019/11/20");
    
      script_cve_id(
        "CVE-2016-4006",
        "CVE-2016-4076",
        "CVE-2016-4077",
        "CVE-2016-4078",
        "CVE-2016-4079",
        "CVE-2016-4080",
        "CVE-2016-4081",
        "CVE-2016-4082",
        "CVE-2016-4083",
        "CVE-2016-4084"
      );
      script_xref(name:"EDB-ID", value:"39503");
      script_xref(name:"EDB-ID", value:"39604");
      script_xref(name:"EDB-ID", value:"39644");
    
      script_name(english:"Wireshark 2.0.x < 2.0.3 Multiple DoS (Mac OS X)");
      script_summary(english:"Checks the version of Wireshark.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Mac OS X host has an application installed that is affected
    by multiple denial of service vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Wireshark installed on the remote Mac OS X host is
    2.0.x prior to 2.0.3. It is, therefore, affected by multiple denial of
    service vulnerabilities in the following components :
    
      - GSM CBCH dissector
      - IAX2 dissector
      - IEEE 802.11 dissector
      - MS-WSP dissector
      - NCP dissector
      - PKTC dissector
      - TShark");
      script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Wireshark version 2.0.3 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-4084");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/02/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/04/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/04/29");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:wireshark:wireshark");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("macosx_wireshark_installed.nbin");
      script_require_keys("installed_sw/Wireshark");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("install_func.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    get_kb_item_or_exit("Host/MacOSX/Version");
    
    app_name = "Wireshark";
    install = get_single_install(app_name:app_name, exit_if_unknown_ver:TRUE);
    version = install['version'];
    path    = install['path'];
    fix = '2.0.3';
    
    # Affected :
    #  2.0.x < 2.0.2
    if (version =~ '^2\\.0\\.' && ver_compare(ver:version, fix:fix, strict:FALSE) < 0)
    {
    
      report =
        '\n  Path              : ' + path +
        '\n  Installed version : ' + version +
        '\n  Fixed version     : ' + fix +
        '\n';
    
      security_report_v4(port:0, severity:SECURITY_WARNING, extra:report);
    }
    else audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, path);
    
  • NASL familyWindows
    NASL idWIRESHARK_2_0_3.NASL
    descriptionThe version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.3. It is, therefore, affected by multiple denial of service vulnerabilities in the following components : - GSM CBCH dissector - IAX2 dissector - IEEE 802.11 dissector - MS-WSP dissector - NCP dissector - PKTC dissector - TShark
    last seen2020-06-01
    modified2020-06-02
    plugin id90787
    published2016-04-29
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90787
    titleWireshark 2.0.x < 2.0.3 Multiple DoS
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(90787);
      script_version("1.7");
      script_cvs_date("Date: 2019/11/20");
    
      script_cve_id(
        "CVE-2016-4006",
        "CVE-2016-4076",
        "CVE-2016-4077",
        "CVE-2016-4078",
        "CVE-2016-4079",
        "CVE-2016-4080",
        "CVE-2016-4081",
        "CVE-2016-4082",
        "CVE-2016-4083",
        "CVE-2016-4084"
      );
      script_xref(name:"EDB-ID", value:"39503");
      script_xref(name:"EDB-ID", value:"39604");
      script_xref(name:"EDB-ID", value:"39644");
    
      script_name(english:"Wireshark 2.0.x < 2.0.3 Multiple DoS");
      script_summary(english:"Checks the version of Wireshark.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host has an application installed that is affected
    by multiple denial of service vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Wireshark installed on the remote Windows host is 2.0.x
    prior to 2.0.3. It is, therefore, affected by multiple denial of
    service vulnerabilities in the following components :
    
      - GSM CBCH dissector
      - IAX2 dissector
      - IEEE 802.11 dissector
      - MS-WSP dissector
      - NCP dissector
      - PKTC dissector
      - TShark");
      script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Wireshark version 2.0.3 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-4084");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/02/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/04/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/04/29");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:wireshark:wireshark");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("wireshark_installed.nasl");
      script_require_keys("installed_sw/Wireshark");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("install_func.inc");
    
    app_name = "Wireshark";
    install = get_single_install(app_name:app_name, exit_if_unknown_ver:TRUE);
    version = install['version'];
    path    = install['path'];
    fix = '2.0.3';
    
    # Affected :
    #  2.0.x < 2.0.2
    if (version =~ '^2\\.0\\.' && ver_compare(ver:version, fix:fix, strict:FALSE) < 0)
    {
      port = get_kb_item("SMB/transport");
      if (!port) port = 445;
    
      report =
        '\n  Path              : ' + path +
        '\n  Installed version : ' + version +
        '\n  Fixed version     : ' + fix +
        '\n';
    
      security_report_v4(port:port, severity:SECURITY_WARNING, extra:report);
    }
    else audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, path);
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_7E36C36910C011E694FA002590263BF5.NASL
    descriptionWireshark development team reports : The following vulnerabilities have been fixed : - wnpa-sec-2016-19 The NCP dissector could crash. (Bug 11591) - wnpa-sec-2016-20 TShark could crash due to a packet reassembly bug. (Bug 11799) - wnpa-sec-2016-21 The IEEE 802.11 dissector could crash. (Bug 11824, Bug 12187) - wnpa-sec-2016-22 The PKTC dissector could crash. (Bug 12206) - wnpa-sec-2016-23 The PKTC dissector could crash. (Bug 12242) - wnpa-sec-2016-24 The IAX2 dissector could go into an infinite loop. (Bug 12260) - wnpa-sec-2016-25 Wireshark and TShark could exhaust the stack. (Bug 12268) - wnpa-sec-2016-26 The GSM CBCH dissector could crash. (Bug 12278) - wnpa-sec-2016-27 MS-WSP dissector crash. (Bug 12341)
    last seen2020-06-01
    modified2020-06-02
    plugin id90846
    published2016-05-03
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90846
    titleFreeBSD : wireshark -- multiple vulnerabilities (7e36c369-10c0-11e6-94fa-002590263bf5)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(90846);
      script_version("2.5");
      script_cvs_date("Date: 2018/11/21 10:46:31");
    
      script_cve_id("CVE-2016-4006", "CVE-2016-4076", "CVE-2016-4077", "CVE-2016-4078", "CVE-2016-4079", "CVE-2016-4080", "CVE-2016-4081", "CVE-2016-4082", "CVE-2016-4083", "CVE-2016-4084");
    
      script_name(english:"FreeBSD : wireshark -- multiple vulnerabilities (7e36c369-10c0-11e6-94fa-002590263bf5)");
      script_summary(english:"Checks for updated packages in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote FreeBSD host is missing one or more security-related
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Wireshark development team reports :
    
    The following vulnerabilities have been fixed :
    
    - wnpa-sec-2016-19
    
    The NCP dissector could crash. (Bug 11591)
    
    - wnpa-sec-2016-20
    
    TShark could crash due to a packet reassembly bug. (Bug 11799)
    
    - wnpa-sec-2016-21
    
    The IEEE 802.11 dissector could crash. (Bug 11824, Bug 12187)
    
    - wnpa-sec-2016-22
    
    The PKTC dissector could crash. (Bug 12206)
    
    - wnpa-sec-2016-23
    
    The PKTC dissector could crash. (Bug 12242)
    
    - wnpa-sec-2016-24
    
    The IAX2 dissector could go into an infinite loop. (Bug 12260)
    
    - wnpa-sec-2016-25
    
    Wireshark and TShark could exhaust the stack. (Bug 12268)
    
    - wnpa-sec-2016-26
    
    The GSM CBCH dissector could crash. (Bug 12278)
    
    - wnpa-sec-2016-27
    
    MS-WSP dissector crash. (Bug 12341)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html"
      );
      # http://www.openwall.com/lists/oss-security/2016/04/25/2
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.openwall.com/lists/oss-security/2016/04/25/2"
      );
      # https://vuxml.freebsd.org/freebsd/7e36c369-10c0-11e6-94fa-002590263bf5.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?35788cf4"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:tshark");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:tshark-lite");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:wireshark");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:wireshark-lite");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:wireshark-qt5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/04/22");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/05/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/05/03");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"wireshark<2.0.3")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"wireshark-lite<2.0.3")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"wireshark-qt5<2.0.3")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"tshark<2.0.3")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"tshark-lite<2.0.3")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");