ArchLinux: 201505-11: wireshark-qt: denial of service
Summary
- CVE-2015-3808 (denial of service)
There is an infinite loop condition in dissect_lbmr_pser() in
epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the
the variable 'option_len' to 0, causing the loop to never terminate.
This issue is leading to excessive CPU resources consumption by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.
- CVE-2015-3809 (denial of service)
There is an infinite loop condition in dissect_lbmr_pser() in
epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the
the variable 'option_len' to 0, causing the loop to never terminate.
This issue is leading to excessive CPU resources consumption by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.
- CVE-2015-3810 (denial of service)
The Websocket dissector recurses to dissect more data. Since the minimum
valid websocket frame length is two bytes, this allows for quite some
recursion. With a minimal IP and TCP header (20 bytes each), you can get
32747 recursions which is leading to excessive CPU resources consumption
by injecting a malformed packet onto the wire or by convincing someone
to read a malformed packet trace file.
- CVE-2015-3811 (denial of service)
The WCP dissector could crash while decompressing data. The compression
format is basically saying "these n bytes are the same as these other n
bytes you've already seen at offset X" except we haven't processed X
bytes yet so we're not validating that offset and are getting
uninitialized bytes leading to a crash when injecting a malformed packet
onto the wire or by convincing someone to read a malformed packet trace
file.
- CVE-2015-3812 (denial of service)
It has been discovered that the X11 dissector could leak memory under
certain circumstances. This may lead to crash by excessive memory
consumption via injecting malformed packets onto the wire or by
convincing someone to read a malformed packet trace file.
- CVE-2015-3813 (denial of service)
It has been discovered that the packet reassembly code could leak memory
under certain circumstances. This may lead to crash by excessive memory
consumption via injecting malformed packets onto the wire or by
convincing someone to read a malformed packet trace file.
- CVE-2015-3814 (denial of service)
It has been discovered that the IEEE 802.11 dissector could go into an
infinite loop under certain circumstances. This issue is leading to
excessive CPU resources consumption by injecting a malformed packet onto
the wire or by convincing someone to read a malformed packet trace file.
- CVE-2015-3815 (denial of service)
It has been discovered that the Android Logcat file parser could crash
under certain circumstances. This issue is leading to denial of service
by injecting a malformed packet onto the wire or by convincing someone
to read a malformed packet trace file.
Resolution
Upgrade to 1.12.5-1.
# pacman -Syu "wireshark-qt>=1.12.5-1"
The problems have been fixed upstream in version 1.12.5.
References
https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3808 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3809 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3810 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3811 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3812 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3813 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3814 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3815
Workaround
None.
