Summary
Name: Multiple problems in Wireshark
Docid: wnpa-sec-2007-02
Date: June 29, 2007
Versions affected: 0.8.20 up to and including 0.99.5
Fixed in: 0.99.6
Details
Description
Wireshark 0.99.6 fixes the following vulnerabilities:
-
Wireshark could crash when dissecting an HTTP chunked
response.
(Bug 1394)
Versions affected: 0.99.5 -
On some systems, Wireshark could crash while reading
iSeries capture files.
(Bug 1415)
Versions affected: 0.10.14 to 0.99.5 -
Wireshark could exhaust system memory while reading a malformed
DCP ETSI packet.
(Bug 1264)
Versions affected: 0.99.5 -
Wireshark could loop excessively while reading a malformed SSL
packet.
(Bug 1582)
Versions affected: 0.8.20 to 0.99.5 -
The DHCP/BOOTP dissector was susceptible to an off-by-one error.
(Bug 1416)
Versions affected: 0.10.17 to 0.99.5 -
Wireshark could loop excessively while reading a malformed MMS
packet.
(Bug 1342)
Versions affected: 0.10.12 to 0.99.5
Impact
It may be possible to make Wireshark or Ethereal crash or use up available memory by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
Resolution
Upgrade to Wireshark 0.99.6.
If are running Wireshark 0.99.5 or Ethereal 0.99.0 or earlier and cannot upgrade, you can work around each of the problems listed above by doing the following:
- Disable the HTTP, DCP ETSI, SSL, DHCP/BOOTP, and MMS dissectors.
- Select Analyze→Enabled Protocols... from the menu.
- Make sure "HTTP", "DCP (ETSI)", "SSL", "BOOTP/DHCP", and "MMS" are un-checked.
- Click "Save", then click "OK".