Risk | High |
Patch available | YES |
Number of vulnerabilities | 3 |
CVE-ID | CVE-2011-1590 CVE-2011-1591 CVE-2011-1142 |
CWE-ID | CWE-399 CWE-121 |
Exploitation vector | Network |
Public exploit | Public exploit code for vulnerability #2 is available. |
Vulnerable software Subscribe |
Wireshark Server applications / IDS/IPS systems, Firewalls and proxy servers |
Vendor | Wireshark.org |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
EUVDB-ID: #VU45101
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2011-1590
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform service disruption.
The X.509if dissector in Wireshark 1.2.x before 1.2.16 and 1.4.x before 1.4.5 does not properly initialize certain global variables, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file.
MitigationInstall update from vendor's website.
Vulnerable software versionsWireshark: 1.2.0 - 1.4.4
CPE2.3http://anonsvn.wireshark.org/viewvc?revision=36608&view=revision
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058900.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058983.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058993.html
http://openwall.com/lists/oss-security/2011/04/18/2
http://openwall.com/lists/oss-security/2011/04/18/8
http://secunia.com/advisories/44172
http://secunia.com/advisories/44374
http://secunia.com/advisories/44822
http://secunia.com/advisories/45149
http://secunia.com/advisories/48947
http://securitytracker.com/id?1025388
http://www.debian.org/security/2011/dsa-2274
http://www.mandriva.com/security/advisories?name=MDVSA-2011:083
http://www.osvdb.org/71846
http://www.vupen.com/english/advisories/2011/1022
http://www.vupen.com/english/advisories/2011/1106
http://www.wireshark.org/security/wnpa-sec-2011-05.html
http://www.wireshark.org/security/wnpa-sec-2011-06.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5754
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5793
http://hermes.opensuse.org/messages/8701428
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15050
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU45102
Risk: High
CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2011-1591
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing a crafted .pcap file. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall update from vendor's website.
Vulnerable software versionsWireshark: 1.4.0 - 1.4.4
CPE2.3 External linkshttp://lists.fedoraproject.org/pipermail/package-announce/2011-April/058900.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058983.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058993.html
http://openwall.com/lists/oss-security/2011/04/18/2
http://openwall.com/lists/oss-security/2011/04/18/8
http://secunia.com/advisories/44172
http://secunia.com/advisories/44374
http://securitytracker.com/id?1025389
http://www.exploit-db.com/exploits/17185
http://www.exploit-db.com/exploits/17195
http://www.kb.cert.org/vuls/id/243670
http://www.mandriva.com/security/advisories?name=MDVSA-2011:083
http://www.osvdb.org/71848
http://www.vupen.com/english/advisories/2011/1022
http://www.vupen.com/english/advisories/2011/1106
http://www.wireshark.org/security/wnpa-sec-2011-06.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5836
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5838
http://exchange.xforce.ibmcloud.com/vulnerabilities/66834
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15000
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU45258
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2011-1142
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform service disruption.
Stack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of service (infinite loop) via vectors involving self-referential ASN.1 CHOICE values.
MitigationInstall update from vendor's website.
Vulnerable software versionsWireshark: 1.2.0 - 1.4.4
CPE2.3http://www.mandriva.com/security/advisories?name=MDVSA-2011:044
http://www.securitytracker.com/id?1025148
http://www.vupen.com/english/advisories/2011/0622
http://www.wireshark.org/docs/relnotes/wireshark-1.2.15.html
http://www.wireshark.org/docs/relnotes/wireshark-1.4.4.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1516
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14724
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.