TECHNICAL BULLETIN

T-233: Wireshark 1.2.1 Multiple Vulnerabilities

September 17, 2009 13:00 GMT


PROBLEM:	Wireshark is prone to multiple denial-of-service vulnerabilities.
PLATFORM:	Wireshark 0.99.6 up to and including 1.2.1
ABSTRACT:	It may be possible to make Wireshark crash remotely or by convincing someone to read a malformed packet trace file.

LINKS:
DOE-CIRC BULLETIN:	http://www.doecirc.energy.gov/bulletins/t-233.shtml
OTHER LINKS:	Security Focus http://www.securityfocus.com/bid/36408/info Wireshark http://www.wireshark.org/

IMPACT ASSESSMENT:	This risk is low. Exploiting these issues may allow attackers to crash the application and deny service to legitimate users.

Discussion:
Wireshark 1.2.2 fixes the following vulnerabilities:

* The GSM A RR dissector could crash. (Bug 3893)
  Versions affected: 1.2.0 to 1.2.1
* The OpcUa dissector could use excessive CPU and memory. (Bug 3986)
  Versions affected: 0.99.6 to 1.0.8, 1.2.0 to 1.2.1
* The TLS dissector could crash on some platforms. (Bug 4008)
  Versions affected: 1.2.0 to 1.2.1 

It may be possible to make Wireshark crash remotely or by convincing someone to read a malformed packet trace file. 

Packet capture files that trigger these issues have been provided. Note that Symantec has not tested or verified these files. 

http://www.securityfocus.com/data/vulnerabilities/exploits/36408-TLS.zip
http://www.securityfocus.com/data/vulnerabilities/exploits/36408-OPCUA.pcap
http://www.securityfocus.com/data/vulnerabilities/exploits/36408-GSM.pcap

Solution:
Upgrade to Wireshark 1.2.2 or later.

If are running Wireshark 1.2.1 or earlier (including Ethereal) and cannot upgrade, you can work around each of the problems listed above by doing the following:

* Disable the affected dissectors:
   o Select Analyze→Enabled Protocols... from the menu.
   o Make sure "GSM CCCH", "OpcUa", and "SSL" are all un-checked.
   o Click "Save", then click "OK".

DOE-CIRC services are available to DOE, DOE Contractors, and the NIH. DOE-CIRC can be contacted at:

    Voice:          866-941-2472
    E-mail:          doecirc@doecirc.energy.gov
    World Wide Web:  http://www.doecirc.energy.gov

UCRL-MI-119788