Vulnerability identifier: #VU45101

Vulnerability risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1590

CWE-ID: CWE-399

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Wireshark
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Wireshark.org

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The X.509if dissector in Wireshark 1.2.x before 1.2.16 and 1.4.x before 1.4.5 does not properly initialize certain global variables, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Wireshark: 1.2.0 - 1.2.15, 1.4.0 - 1.4.4

---

External links
http://anonsvn.wireshark.org/viewvc?revision=36608&view=revision
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058900.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058983.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058993.html
http://openwall.com/lists/oss-security/2011/04/18/2
http://openwall.com/lists/oss-security/2011/04/18/8
http://secunia.com/advisories/44172
http://secunia.com/advisories/44374
http://secunia.com/advisories/44822
http://secunia.com/advisories/45149
http://secunia.com/advisories/48947
http://securitytracker.com/id?1025388
http://www.debian.org/security/2011/dsa-2274
http://www.mandriva.com/security/advisories?name=MDVSA-2011:083
http://www.osvdb.org/71846
http://www.vupen.com/english/advisories/2011/1022
http://www.vupen.com/english/advisories/2011/1106
http://www.wireshark.org/security/wnpa-sec-2011-05.html
http://www.wireshark.org/security/wnpa-sec-2011-06.html
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5754
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5793
http://hermes.opensuse.org/messages/8701428
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15050

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.