#VU45101 Resource management error in Wireshark - CVE-2011-1590
Vulnerability identifier: #VU45101
Vulnerability risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2011-1590
CWE-ID:
CWE-399
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Wireshark
Server applications /
IDS/IPS systems, Firewalls and proxy servers
Vendor: Wireshark.org
Description
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The X.509if dissector in Wireshark 1.2.x before 1.2.16 and 1.4.x before 1.4.5 does not properly initialize certain global variables, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Wireshark: 1.2.0 - 1.2.15, 1.4.0 - 1.4.4
External links
https://anonsvn.wireshark.org/viewvc?revision=36608&view=revision
https://lists.fedoraproject.org/pipermail/package-announce/2011-April/058900.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-April/058983.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-April/058993.html
https://openwall.com/lists/oss-security/2011/04/18/2
https://openwall.com/lists/oss-security/2011/04/18/8
https://secunia.com/advisories/44172
https://secunia.com/advisories/44374
https://secunia.com/advisories/44822
https://secunia.com/advisories/45149
https://secunia.com/advisories/48947
https://securitytracker.com/id?1025388
https://www.debian.org/security/2011/dsa-2274
https://www.mandriva.com/security/advisories?name=MDVSA-2011:083
https://www.osvdb.org/71846
https://www.vupen.com/english/advisories/2011/1022
https://www.vupen.com/english/advisories/2011/1106
https://www.wireshark.org/security/wnpa-sec-2011-05.html
https://www.wireshark.org/security/wnpa-sec-2011-06.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5754
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5793
https://hermes.opensuse.org/messages/8701428
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15050
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
