Multiple vulnerabilities in Wireshark

1) Input validation error

EUVDB-ID: #VU40326

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-4420

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The NFS dissector in Wireshark 2.x before 2.0.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 2.0.0 - 2.0.1

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:2.0.1:*:*:*:*:*:*:*

External links

http://www.wireshark.org/security/wnpa-sec-2016-17.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource management error

EUVDB-ID: #VU40327

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-4419

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

epan/dissectors/packet-spice.c in the SPICE dissector in Wireshark 2.x before 2.0.2 mishandles capability data, which allows remote attackers to cause a denial of service (large loop) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 2.0.0 - 2.0.1

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:2.0.1:*:*:*:*:*:*:*

External links

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12151
http://www.wireshark.org/security/wnpa-sec-2016-16.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU40328

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-4416

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.2 mishandles the Grouping subfield, which. A remote attacker can perform a denial of service (buffer over-read and application crash) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 2.0.0 - 2.0.1

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:2.0.1:*:*:*:*:*:*:*

External links

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11818
http://www.wireshark.org/security/wnpa-sec-2016-13.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Heap-based buffer overflow

EUVDB-ID: #VU40329

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-4415

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in wiretap/vwr.c in the Ixia IxVeriWave file parser in Wireshark 2.x before 2.0.2 incorrectly increases a certain octet count, which. A remote attacker can use a crafted file. to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 2.0.0 - 2.0.1

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:2.0.1:*:*:*:*:*:*:*

External links

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11795
http://code.google.com/p/google-security-research/issues/detail?id=647
http://www.wireshark.org/security/wnpa-sec-2016-12.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU40443

Risk: Medium

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-2529

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to perform denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the wiretap/iseries.c function in the iSeries file parser file. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and crash the affected application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 2.0.0 - 2.0.1

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:2.0.1:*:*:*:*:*:*:*

External links

http://www.securitytracker.com/id/1035118
http://www.wireshark.org/security/wnpa-sec-2016-09.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11985
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=96d585a5e9baef21e1eea8505d78305b034dc80e
http://security.gentoo.org/glsa/201604-05

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Stack-based buffer overflow

EUVDB-ID: #VU40444

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-2527

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing a crafted file. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 2.0.0 - 2.0.1

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:2.0.1:*:*:*:*:*:*:*

External links

http://www.securitytracker.com/id/1035118
http://www.wireshark.org/security/wnpa-sec-2016-07.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11982
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=140aad08e081489b5cdb715cb5bca01db856fded
http://security.gentoo.org/glsa/201604-05

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Stack-based buffer overflow

EUVDB-ID: #VU40445

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-2528

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector when processing a crafted packet. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 2.0.0 - 2.0.1

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:2.0.1:*:*:*:*:*:*:*

External links

http://www.securitytracker.com/id/1035118
http://www.wireshark.org/security/wnpa-sec-2016-08.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11984
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=1c090e929269a78bf7a4cb3dc0d34565f4351312
http://security.gentoo.org/glsa/201604-05

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Input validation error

EUVDB-ID: #VU40446

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-2526

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 2.0.0 - 2.0.1

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:2.0.1:*:*:*:*:*:*:*

External links

http://www.securitytracker.com/id/1035118
http://www.wireshark.org/security/wnpa-sec-2016-06.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11983
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=69a679cc3a9c087064b7e9521b9e9f3c40dd0b72
http://security.gentoo.org/glsa/201604-05

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Input validation error

EUVDB-ID: #VU40447

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-2525

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 2.0.0 - 2.0.1

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:2.0.1:*:*:*:*:*:*:*

External links

http://www.securitytracker.com/id/1035118
http://www.wireshark.org/security/wnpa-sec-2016-05.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12077
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=6a47ac7624993b99966e1d813245ffb419a2d201
http://security.gentoo.org/glsa/201604-05

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Input validation error

EUVDB-ID: #VU40448

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-2524

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 2.0.0 - 2.0.1

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:2.0.1:*:*:*:*:*:*:*

External links

http://www.securitytracker.com/id/1035118
http://www.wireshark.org/security/wnpa-sec-2016-04.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12002
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=5a8020a1b6bb73fcb8bb7eb7d53177bc8a9fc703
http://security.gentoo.org/glsa/201604-05

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Out-of-bounds read

EUVDB-ID: #VU40449

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-2522

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to perform denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the epan/dissectors/packet-ber.c function in the ASN.1 BER dissector file. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and crash the affected application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Wireshark: 2.0.0 - 2.0.1

CPE2.3

cpe:2.3:a:wireshark_org:wireshark:2.0.1:*:*:*:*:*:*:*

External links

http://www.securitytracker.com/id/1035118
http://www.wireshark.org/security/wnpa-sec-2016-02.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11828
http://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=9b2f3f7c5c9205381cb72e42b66e97d8ed3abf63
http://security.gentoo.org/glsa/201604-05

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	11
CVE-ID	CVE-2016-4420 CVE-2016-4419 CVE-2016-4416 CVE-2016-4415 CVE-2016-2529 CVE-2016-2527 CVE-2016-2528 CVE-2016-2526 CVE-2016-2525 CVE-2016-2524 CVE-2016-2522
CWE-ID	CWE-20 CWE-399 CWE-125 CWE-122 CWE-121
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Wireshark Server applications / IDS/IPS systems, Firewalls and proxy servers
Vendor	Wireshark.org