Summary
Name: MAC-LTE, ENTTEC, and ASN.1 BER vulnerabilities in Wireshark
Docid: wnpa-sec-2011-02
Date: January 11, 2011
Versions affected: 1.4.0
Related: wnpa-sec-2010-13
(MAC-LTE and ENTTEC vulnerabilities in Wireshark
Details
Description
Wireshark 1.4.3 fixes the following vulnerabilities:
- FRAsse discovered that the MAC-LTE dissector could overflow a buffer. (Bug 5530) Versions affected: 1.2.0 to 1.2.13 and 1.4.0 to 1.4.2. CVE-2011-0444
- FRAsse discovered that the ENTTEC dissector could overflow a buffer. (Bug 5539) Versions affected: 1.2.0 to 1.2.13 and 1.4.0 to 1.4.2. CVE-2010-4538
- The ASN.1 BER dissector could assert and make Wireshark exit prematurely. (Bug 5537) Versions affected: 1.4.0 to 1.4.2. CVE-2011-0445
Impact
It may be possible to make Wireshark crash by injecting a series of malformed packets onto the wire or by convincing someone to read a malformed packet trace file.
Resolution
Upgrade to Wireshark 1.4.3 or later.
If are running Wireshark 1.4.2 or earlier (including Ethereal) and cannot upgrade, you can work around each of the problems listed above by doing the following:
- Disable the ENTTEC and MAC-LTE dissectors (there is no workaround for the BER issue):
- Select Analyze→Enabled Protocols... from the menu.
- Make sure "ENTTEC" and "MAC-LTE" are un-checked.
- Click "Save", then click "OK".