ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

wnpa-sec-2011-10 · Lucent/Ascend file parser and ANSI MAP vulnerabilities in Wireshark

Summary

Name: Lucent/Ascend file parser and ANSI MAP vulnerabilities in Wireshark

Docid: wnpa-sec-2011-10

Date: July 18, 2011

Affected versions: 1.4.0 up to and including 1.4.7

Fixed versions: 1.4.8

Details

Description

Wireshark 1.4.8 fixes the following vulnerabilities:

  • The Lucent/Ascend file parser was susceptible to an infinite loop.
    Versions affected: 1.2.0 to 1.2.17, 1.4.0 to 1.4.7, and 1.6.0.
    CVE-2011-2597
  • The ANSI MAP dissector was susceptible to an infinite loop. (Bug 6044)
    Versions affected: 1.4.0 to 1.4.7 and 1.6.0.
    CVE-2011-2698

Impact

It may be possible to make Wireshark crash by injecting a series of malformed packets onto the wire or by convincing someone to read a malformed packet trace file.

Resolution

Upgrade to Wireshark 1.4.8 or later. Although you can disable the ANSI MAP dissector it is not possible to work around the Lucent/Ascend parser bug.