Multiple vulnerabilities in Wireshark

1) Input validation error

EUVDB-ID: #VU41944

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-2281

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted NFS packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.8.0 - 1.10.5

CPE2.3

• cpe:2.3:a:wireshark_org:wireshark:1.8.12:*:*:*:*:*:*:*
• cpe:2.3:a:wireshark_org:wireshark:1.10.5:*:*:*:*:*:*:*

External links

http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-nfs.c?r1=54875&r2=54874&pathrev=54875
http://anonsvn.wireshark.org/viewvc?view=revision&revision=54875
http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html
http://lists.opensuse.org/opensuse-updates/2014-03/msg00047.html
http://rhn.redhat.com/errata/RHSA-2014-0341.html
http://rhn.redhat.com/errata/RHSA-2014-0342.html
http://secunia.com/advisories/57480
http://secunia.com/advisories/57489
http://www.debian.org/security/2014/dsa-2871
http://www.securitytracker.com/id/1029907
http://www.wireshark.org/security/wnpa-sec-2014-01.html
http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_wireshark10
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9672

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU41945

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-2282

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The dissect_protocol_data_parameter function in epan/dissectors/packet-m3ua.c in the M3UA dissector in Wireshark 1.10.x before 1.10.6 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted SS7 MTP3 packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.10.0 - 1.10.5

CPE2.3

• cpe:2.3:a:wireshark_org:wireshark:1.10.5:*:*:*:*:*:*:*

External links

http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-m3ua.c?r1=51608&r2=51607&pathrev=51608
http://anonsvn.wireshark.org/viewvc?view=revision&revision=51608
http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html
http://secunia.com/advisories/57480
http://www.securitytracker.com/id/1029907
http://www.wireshark.org/security/wnpa-sec-2014-02.html
http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_wireshark10
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9699

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU41946

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-2283

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (use-after-free error and application crash) via a crafted UMTS Radio Link Control packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.8.0 - 1.10.5

CPE2.3

• cpe:2.3:a:wireshark_org:wireshark:1.8.12:*:*:*:*:*:*:*
• cpe:2.3:a:wireshark_org:wireshark:1.10.5:*:*:*:*:*:*:*

External links

http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html
http://lists.opensuse.org/opensuse-updates/2014-03/msg00047.html
http://rhn.redhat.com/errata/RHSA-2014-0342.html
http://secunia.com/advisories/57480
http://secunia.com/advisories/57489
http://www.debian.org/security/2014/dsa-2871
http://www.securitytracker.com/id/1029907
http://www.wireshark.org/security/wnpa-sec-2014-03.html
http://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_wireshark10
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9730
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9802
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=217293ba4a0353bf5d657e74fe8623dd3c86fe08

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU41947

Risk: High

CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2014-2299

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.8.0 - 1.10.5

CPE2.3

• cpe:2.3:a:wireshark_org:wireshark:1.8.12:*:*:*:*:*:*:*
• cpe:2.3:a:wireshark_org:wireshark:1.10.5:*:*:*:*:*:*:*

External links

http://lists.opensuse.org/opensuse-updates/2014-03/msg00046.html
http://lists.opensuse.org/opensuse-updates/2014-03/msg00047.html
http://osvdb.org/show/osvdb/104199
http://packetstormsecurity.com/files/126337/Wireshark-1.8.12-1.10.5-wiretap-mpeg.c-Stack-Buffer-Overflow.html
http://rhn.redhat.com/errata/RHSA-2014-0341.html
http://rhn.redhat.com/errata/RHSA-2014-0342.html
http://secunia.com/advisories/57480
http://secunia.com/advisories/57489
http://www.debian.org/security/2014/dsa-2871
http://www.exploit-db.com/exploits/33069
http://www.securityfocus.com/bid/66066
http://www.securitytracker.com/id/1029907
http://www.wireshark.org/security/wnpa-sec-2014-04.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9843
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f567435ac7140c96a5de56dbce3d5e7659af4d09

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.