Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

wnpa-sec-2011-06 · DECT, NFS, and X.509if vulnerabilities in Wireshark

Summary

Name: DECT, NFS, and X.509if vulnerabilities in Wireshark

Docid: wnpa-sec-2011-06

Date: April 15, 2011

Affected versions: 1.4.0

Fixed versions: 1.4.5

Details

Description

Wireshark 1.4.5 fixes the following vulnerabilities:

  • The NFS dissector could crash on Windows. (Bug 5209)
    Versions affected: 1.4.0 to 1.4.4.
  • The X.509if dissector could crash. (Bug 5754, Bug 5793)
    Versions affected: 1.2.0 to 1.2.15 and 1.4.0 to 1.4.4.
  • Paul Makowski from SEI/CERT discovered that the DECT dissector could overflow a buffer. He verified that this could allow remote code execution on many platforms.
    Versions affected: 1.4.0 to 1.4.4.

Impact

It may be possible to make Wireshark crash by injecting a series of malformed packets onto the wire or by convincing someone to read a malformed packet trace file.

Resolution

Upgrade to Wireshark 1.4.5 or later.

If are running Wireshark {{ end_version }} or earlier (including Ethereal) and cannot upgrade, you can work around the problem listed above by doing the following:

  • Disable the DECT, NFS (if you're running Windows), and X.509if dissectors:
    • Select Analyze→Enabled Protocols... from the menu.
    • Make sure "DECT", "NFS", and "X.509if" are un-checked.
    • Click "Save", then click "OK".