Multiple vulnerabilities in Wireshark

Published: 2011-03-03 | Updated: 2022-03-24

Risk	High
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2011-1590 CVE-2011-1591 CVE-2011-1142
CWE-ID	CWE-399 CWE-121
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #2 is available.
Vulnerable software	Wireshark Server applications / IDS/IPS systems, Firewalls and proxy servers
Vendor	Wireshark.org

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Resource management error

EUVDB-ID: #VU45101

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1590

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The X.509if dissector in Wireshark 1.2.x before 1.2.16 and 1.4.x before 1.4.5 does not properly initialize certain global variables, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.2.0 - 1.4.4

CPE2.3

External links

https://anonsvn.wireshark.org/viewvc?revision=36608&view=revision
https://lists.fedoraproject.org/pipermail/package-announce/2011-April/058900.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-April/058983.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-April/058993.html
https://openwall.com/lists/oss-security/2011/04/18/2
https://openwall.com/lists/oss-security/2011/04/18/8
https://secunia.com/advisories/44172
https://secunia.com/advisories/44374
https://secunia.com/advisories/44822
https://secunia.com/advisories/45149
https://secunia.com/advisories/48947
https://securitytracker.com/id?1025388
https://www.debian.org/security/2011/dsa-2274
https://www.mandriva.com/security/advisories?name=MDVSA-2011:083
https://www.osvdb.org/71846
https://www.vupen.com/english/advisories/2011/1022
https://www.vupen.com/english/advisories/2011/1106
https://www.wireshark.org/security/wnpa-sec-2011-05.html
https://www.wireshark.org/security/wnpa-sec-2011-06.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5754
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5793
https://hermes.opensuse.org/messages/8701428
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15050

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stack-based buffer overflow

EUVDB-ID: #VU45102

Risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2011-1591

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing a crafted .pcap file. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.4.0 - 1.4.4

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:1.4.4:*:*:*:*:*:*:*

External links

https://lists.fedoraproject.org/pipermail/package-announce/2011-April/058900.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-April/058983.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-April/058993.html
https://openwall.com/lists/oss-security/2011/04/18/2
https://openwall.com/lists/oss-security/2011/04/18/8
https://secunia.com/advisories/44172
https://secunia.com/advisories/44374
https://securitytracker.com/id?1025389
https://www.exploit-db.com/exploits/17185
https://www.exploit-db.com/exploits/17195
https://www.kb.cert.org/vuls/id/243670
https://www.mandriva.com/security/advisories?name=MDVSA-2011:083
https://www.osvdb.org/71848
https://www.vupen.com/english/advisories/2011/1022
https://www.vupen.com/english/advisories/2011/1106
https://www.wireshark.org/security/wnpa-sec-2011-06.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5836
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5838
https://exchange.xforce.ibmcloud.com/vulnerabilities/66834
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15000

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Resource management error

EUVDB-ID: #VU45258

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1142

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Stack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of service (infinite loop) via vectors involving self-referential ASN.1 CHOICE values.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.2.0 - 1.4.4

CPE2.3

External links

https://www.mandriva.com/security/advisories?name=MDVSA-2011:044
https://www.securitytracker.com/id?1025148
https://www.vupen.com/english/advisories/2011/0622
https://www.wireshark.org/docs/relnotes/wireshark-1.2.15.html
https://www.wireshark.org/docs/relnotes/wireshark-1.4.4.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1516
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14724

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.