SB2016010402 - Multiple vulnerabilities in Wireshark 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016010402

SB2016010402 - Multiple vulnerabilities in Wireshark

Published: January 4, 2016 Updated: March 24, 2022

Security Bulletin ID SB2016010402
Severity
Medium
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2015-8742)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The dissect_CPMSetBindings function in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.1 does not validate the column size, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.


2) Input validation error (CVE-ID: CVE-2015-8741)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The dissect_ppi function in epan/dissectors/packet-ppi.c in the PPI dissector in Wireshark 2.0.x before 2.0.1 does not initialize a packet-header data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


3) Stack-based buffer overflow (CVE-ID: CVE-2015-8740)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector when processing a crafted packet. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


4) Division by zero (CVE-ID: CVE-2015-8738)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to divide-by-zero error within The s7comm_decode_ud_cpu_szl_subfunc function in epan/dissectors/packet-s7comm_szl_ids.c in the S7COMM dissector in Wireshark 2.0.x before 2.0.1 does not validate the list count in an SZL response, which. A remote attacker can perform a denial of service (divide-by-zero error and application crash) via a crafted packet.


5) Input validation error (CVE-ID: CVE-2015-8739)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The ipmi_fmt_udpport function in epan/dissectors/packet-ipmi.c in the IPMI dissector in Wireshark 2.0.x before 2.0.1 improperly attempts to access a packet scope, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.


6) Division by zero (CVE-ID: CVE-2015-8737)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to divide-by-zero error within The mp2t_open function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not validate the bit rate, which. A remote attacker can perform a denial of service (divide-by-zero error and application crash) via a crafted file.


7) Stack-based buffer overflow (CVE-ID: CVE-2015-8736)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the mp2t_find_next_pcr function in wiretap/mp2t.c in the MP2T file parser when processing a crafted file. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


8) Input validation error (CVE-ID: CVE-2015-8735)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The get_value function in epan/dissectors/packet-btatt.c in the Bluetooth Attribute (aka BT ATT) dissector in Wireshark 2.0.x before 2.0.1 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (invalid write operation and application crash) via a crafted packet.


9) Input validation error (CVE-ID: CVE-2015-8734)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The dissect_nwp function in epan/dissectors/packet-nwp.c in the NWP dissector in Wireshark 2.0.x before 2.0.1 mishandles the packet type, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Remediation

Install update from vendor's website.

References