Multiple vulnerabilities in Wireshark

1) Out-of-bounds read

EUVDB-ID: #VU40760

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-3906

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to perform denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the wiretap/logcat.c function in the Android Logcat file parser file. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and crash the affected application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.12.0 - 1.12.4

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:1.12.4:*:*:*:*:*:*:*

External links

http://www.securityfocus.com/bid/74837
http://www.wireshark.org/security/wnpa-sec-2015-18.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11188
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=b3b1f7c3aa2233a147294bad833b748d38fba84d
http://security.gentoo.org/glsa/201510-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU40763

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-3815

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to perform denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the wiretap/logcat.c function in the Android Logcat file parser file. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and crash the affected application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.12.0 - 1.12.4

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:1.12.4:*:*:*:*:*:*:*

External links

http://www.debian.org/security/2015/dsa-3277
http://www.securityfocus.com/bid/74630
http://www.wireshark.org/security/wnpa-sec-2015-18.html
http://blog.fuzzing-project.org/11-Read-heap-overflow-invalid-memory-access-in-Wireshark-TFPA-0072015.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11188
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=b3b1f7c3aa2233a147294bad833b748d38fba84d
http://security.gentoo.org/glsa/201510-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource management error

EUVDB-ID: #VU40765

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-3813

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The fragment_add_work function in epan/reassemble.c in the packet-reassembly feature in Wireshark 1.12.x before 1.12.5 does not properly determine the defragmentation state in a case of an insufficient snapshot length, which allows remote attackers to cause a denial of service (memory consumption) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.12.0 - 1.12.4

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:1.12.4:*:*:*:*:*:*:*

External links

http://rhn.redhat.com/errata/RHSA-2017-0631.html
http://www.debian.org/security/2015/dsa-3277
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/74633
http://www.wireshark.org/security/wnpa-sec-2015-16.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11129
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=c35f2ccb4433718416551cc7a85afb0860529d57
http://security.gentoo.org/glsa/201510-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Resource management error

EUVDB-ID: #VU40766

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-3810

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.12.0 - 1.12.4

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:1.12.4:*:*:*:*:*:*:*

External links

http://www.debian.org/security/2015/dsa-3277
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/74629
http://www.wireshark.org/security/wnpa-sec-2015-13.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10989
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=4ee6bcbd2e03a25f1e6b0239558d9edeaf8040c0
http://security.gentoo.org/glsa/201510-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU40767

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-3809

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not properly track the current offset, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.12.0 - 1.12.4

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:1.12.4:*:*:*:*:*:*:*

External links

http://www.debian.org/security/2015/dsa-3277
http://www.securityfocus.com/bid/74632
http://www.wireshark.org/security/wnpa-sec-2015-12.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11036
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=c19860dba8d158c42865c3d9051b6f318cb41169
http://security.gentoo.org/glsa/201510-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU40768

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-3808

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not reject a zero length, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.12.0 - 1.12.4

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:1.12.4:*:*:*:*:*:*:*

External links

http://www.securityfocus.com/bid/74628
http://www.wireshark.org/security/wnpa-sec-2015-12.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11036
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=c19860dba8d158c42865c3d9051b6f318cb41169
http://security.gentoo.org/glsa/201510-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	6
CVE-ID	CVE-2015-3906 CVE-2015-3815 CVE-2015-3813 CVE-2015-3810 CVE-2015-3809 CVE-2015-3808
CWE-ID	CWE-125 CWE-399 CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Wireshark Server applications / IDS/IPS systems, Firewalls and proxy servers
Vendor	Wireshark.org