インストール済みの Wireshark is のバージョンは 1.2.17 未満の 1.2.x または 1.4.7未満の 1.4.x です。それ自体が、次の脆弱性の影響を受けます：
  - DICOM ディセクタにエラーが存在し、特定の無効な形式のパケットを処理するときに DoS 攻撃（サービス拒否攻撃）を引き起こす可能性があります。（問題#5876）

  - 破損した snoop ファイルの処理に、アプリケーションのクラッシュを引き起こす可能性があるエラーが存在します。（問題#5912）

  - 圧縮されたキャプチャデータに、アプリケーションのクラッシュを引き起こす可能性があるエラーが存在します。（問題#5908）

  - 「Visual Networks」ファイルの処理に、アプリケーションのクラッシュを引き起こす可能性があるエラーが存在します。（問題#5934）

  - ファイル「epan/dissectors/packet-tcp.c」の「desegment_tcp()」関数に、特定の TCP セグメントの処理で、NULL ポインターを逆参照させることができるエラーが存在します。（問題#5837）

  - 破損した「Diameter」辞書ファイルの処理に、アプリケーションのクラッシュを引き起こす可能性があるエラーが存在します。（CVE-2011-1958）

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2012-539:02 advisory.

    Wireshark is a network traffic analyzer for Unix-ish operating systems.
    This package lays base for libpcap, a packet capture and filtering library, contains command-line     utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged     separately to GTK+ package.
    Security issues fixed with this release:
     CVE-2011-1143     epan/dissectors/packet-ntlmssp.c in the NTLMSSP dissector in Wireshark before 1.4.4 allows remote     attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted     .pcap file.
     CVE-2011-1590     The X.509if dissector in Wireshark 1.2.x before 1.2.16 and 1.4.x before 1.4.5 does not properly initialize     certain global variables, which allows remote attackers to cause a denial of service (application crash)     via a crafted .pcap file.
     CVE-2011-1957     The dissect_dcm_main function in epan/dissectors/packet-dcm.c in the DICOM dissector in Wireshark 1.2.x     before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (infinite loop)     via an invalid PDU length.
     CVE-2011-1958     Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows user-assisted remote attackers to cause a     denial of service (NULL pointer dereference and application crash) via a crafted Diameter dictionary file.
     CVE-2011-1959     The snoop_read function in wiretap/snoop.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 does     not properly handle certain virtualizable buffers, which allows remote attackers to cause a denial of     service (application crash) via a large length value in a snoop file that triggers a stack-based buffer     over-read.
     CVE-2011-2174     Double free vulnerability in the tvb_uncompress function in epan/tvbuff.c in Wireshark 1.2.x before 1.2.17     and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a     packet with malformed data that uses zlib compression.
     CVE-2011-2175     Integer underflow in the visual_read function in wiretap/visual.c in Wireshark 1.2.x before 1.2.17 and     1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a     malformed Visual Networks file that triggers a heap-based buffer over-read.
     CVE-2011-2597     The Lucent/Ascend file parser in Wireshark 1.2.x before 1.2.18, 1.4.x through 1.4.7, and 1.6.0 allows     remote attackers to cause a denial of service (infinite loop) via malformed packets.
     CVE-2011-2698     Off-by-one error in the elem_cell_id_aux function in epan/dissectors/packet-ansi_a.c in the ANSI MAP     dissector in Wireshark 1.4.x before 1.4.8 and 1.6.x before 1.6.1 allows remote attackers to cause a denial     of service (infinite loop) via an invalid packet.
     CVE-2011-4102     Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file parser in     Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service     (application crash) via a malformed file.
     CVE-2012-0041     The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service (application crash) via a long packet in a capture     file, as demonstrated by an airopeek file.
     CVE-2012-0042     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions,     which allows remote attackers to cause a denial of service (NULL pointer dereference and application     crash) via a crafted packet, related to epan/to_str.c.
     CVE-2012-0066     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service     (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or     (3) NETMON 2 capture file.
     CVE-2012-0067     wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause     a denial of service (application crash) via a long packet in an AIX iptrace file.
     CVE-2012-1595     The pcap_process_pseudo_header function in wiretap/pcap-common.c in Wireshark 1.4.x before 1.4.12 and     1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a     WTAP_ENCAP_ERF file containing an Extension or Multi-Channel header with an invalid pseudoheader size,     related to the pcap and pcap-ng file parsers.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Huzaifa Sidhpurwala, David Maciejak and others discovered several vulnerabilities in the X.509if and DICOM dissectors and in the code to process various capture and dictionary files, which could lead to denial of service or the execution of arbitrary code.

This update of wireshark fixes the following vulnerabilities :

  - Wireshark IKE dissector vulnerability. (CVE-2011-3266)

  - Wireshark Lua script execution vulnerability.
    (CVE-2011-3360)

  - Wireshark buffer exception handling vulnerability.
    (CVE-2011-3483)

  - Lucent/Ascend file parser susceptible to infinite loop.
    (CVE-2011-2597)

  - ANSI MAP dissector susceptible to infinite loop.
    (CVE-2011-2698)

  - Large/infinite loop in the DICOM dissector.
    (CVE-2011-1957)

  - A corrupted snoop file could crash Wireshark.
    (CVE-2011-1959)

  - Malformed compressed capture data could crash Wireshark.
    (CVE-2011-2174)

  - A corrupted Visual Networks file could crash Wireshark.
    (CVE-2011-2175)

  - dereferene a NULL pointer if we had a corrupted Diameter     dictionary. (CVE-2011-1958)

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-1590, CVE-2011-4102, CVE-2012-1595)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1143, CVE-2011-1957, CVE-2011-1958, CVE-2011-1959, CVE-2011-2174, CVE-2011-2175, CVE-2011-2597, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0067, CVE-2012-0066)

Users of Wireshark should upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.

This update of wireshark fixes the following vulnerabilities :

  - CVE-2011-3266: Wireshark IKE dissector vulnerability

  - CVE-2011-3360: Wireshark Lua script execution     vulnerability

  - CVE-2011-3483: Wireshark buffer exception handling     vulnerability 

  - CVE-2011-2597: Lucent/Ascend file parser susceptible to     infinite loop

  - CVE-2011-2698: ANSI MAP dissector susceptible to     infinite loop 

  - CVE-2011-1957: Large/infinite loop in the DICOM     dissector

  - CVE-2011-1959: A corrupted snoop file could crash     Wireshark

  - CVE-2011-2174: Malformed compressed capture data could     crash Wireshark

  - CVE-2011-2175: A corrupted Visual Networks file could     crash Wireshark

  - CVE-2011-1958: dereferene a NULL pointer if we had a     corrupted Diameter dictionary

The remote host is affected by the vulnerability described in GLSA-201110-02 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send specially crafted packets on a network       being monitored by Wireshark, entice a user to open a malformed packet       trace file using Wireshark, or deploy a specially crafted Lua script for       use by Wireshark, possibly resulting in the execution of arbitrary code,       or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This advisory updates wireshark to the latest version (1.2.17), fixing several security issues :

  - Large/infinite loop in the DICOM dissector. (Bug 5876)     Versions affected: 1.2.0 to 1.2.16 and 1.4.0 to 1.4.6.

  - Huzaifa Sidhpurwala of the Red Hat Security Response     Team discovered that a corrupted Diameter dictionary     file could crash Wireshark. Versions affected: 1.2.0 to     1.2.16 and 1.4.0 to 1.4.6.

  - Huzaifa Sidhpurwala of the Red Hat Security Response     Team discovered that a corrupted snoop file could crash     Wireshark. (Bug 5912) Versions affected: 1.2.0 to 1.2.16     and 1.4.0 to 1.4.6.

  - David Maciejak of Fortinet's FortiGuard Labs discovered     that malformed compressed capture data could crash     Wireshark. (Bug 5908) Versions affected: 1.2.0 to 1.2.16     and 1.4.0 to 1.4.6.

  - Huzaifa Sidhpurwala of the Red Hat Security Response     Team discovered that a corrupted Visual Networks file     could crash Wireshark. (Bug 5934) Versions affected:
    1.2.0 to 1.2.16 and 1.4.0 to 1.4.6.

Upgrade to latest release, fixing few security bugs. See http://www.wireshark.org/docs/relnotes/wireshark-1.2.17.html.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upgrade to latest release, fixing few security bugs. See http://www.wireshark.org/docs/relnotes/wireshark-1.4.7.html.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0509 advisory.

    [1.2.15-2.0.1.el6_2.1]
    - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect

    [1.2.15-2.1]
    - security patches
    - Resolves: CVE-2011-1143                 CVE-2011-1590                 CVE-2011-1957                 CVE-2011-1959                 CVE-2011-2174                 CVE-2011-2175 CVE-2011-1958                 CVE-2011-2597 CVE-2011-2698                 CVE-2011-4102                 CVE-2012-0041 CVE-2012-0066 CVE-2012-0067                 CVE-2012-0042                 CVE-2012-1595

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of wireshark fixes the following vulnerabilities :

  - CVE-2011-3266: Wireshark IKE dissector vulnerability

  - CVE-2011-3360: Wireshark Lua script execution     vulnerability

  - CVE-2011-3483: Wireshark buffer exception handling     vulnerability

  - CVE-2011-2597: Lucent/Ascend file parser susceptible to     infinite loop

  - CVE-2011-2698: ANSI MAP dissector susceptible to     infinite loop

  - CVE-2011-1957: Large/infinite loop in the DICOM     dissector

  - CVE-2011-1959: A corrupted snoop file could crash     Wireshark

  - CVE-2011-2174: Malformed compressed capture data could     crash Wireshark

  - CVE-2011-2175: A corrupted Visual Networks file could     crash Wireshark

  - CVE-2011-1958: dereferene a NULL pointer if we had a     corrupted Diameter dictionary

The installed version of Wireshark is 1.2.x less than 1.2.17 or 1.4.x less than 1.4.7.  As such, it is affected by the following vulnerabilities :
  - An error exists in DICOM dissector that can allow denial     of service attacks when processing certain malformed     packets. (Issue #5876)

  - An error exists in the handling of corrupted snoop     files that can cause application crashes. (Issue #5912)

  - An error exists in the handling of compressed capture     data that can cause application crashes. (Issue #5908)

  - An error exists in the handling of 'Visual Networks'     files that can cause application crashes. (Issue #5934)

  - An error exists in the 'desegment_tcp()' function in the     file 'epan/dissectors/packet-tcp.c' that can allow a NULL     pointer to be dereferenced when handling certain TCP     segments. (Issue #5837)

  - An error exists in the handling of corrupted 'Diameter'     dictionary files that can cause application crashes.     (CVE-2011-1958)

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-1590, CVE-2011-4102, CVE-2012-1595)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1143, CVE-2011-1957, CVE-2011-1958, CVE-2011-1959, CVE-2011-2174, CVE-2011-2175, CVE-2011-2597, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0067, CVE-2012-0066)

Users of Wireshark should upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
54942	Wireshark < 1.2.17 / 1.4.7 の複数の DoS 脆弱性	Nessus	Windows	2011/6/2	2026/3/30	medium
283972	MiracleLinux 4 : wireshark-1.2.15-2.AXS4.1 (AXSA:2012-539:02)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	high
55537	Debian DSA-2274-1 : wireshark - several vulnerabilities	Nessus	Debian Local Security Checks	2011/7/8	2021/1/4	medium
57136	SuSE 11.1 Security Update : wireshark (SAT Patch Number 5281)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	high
58849	CentOS 6 : wireshark (CESA-2012:0509)	Nessus	CentOS Local Security Checks	2012/4/25	2021/1/4	medium
75774	openSUSE Security Update : wireshark (openSUSE-SU-2011:1142-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	high
56426	GLSA-201110-02 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2011/10/10	2021/1/6	critical
54940	Mandriva Linux Security Advisory : wireshark (MDVSA-2011:105)	Nessus	Mandriva Local Security Checks	2011/6/2	2021/1/6	medium
55152	Fedora 13 : wireshark-1.2.17-1.fc13 (2011-7858)	Nessus	Fedora Local Security Checks	2011/6/16	2021/1/11	medium
58841	RHEL 6 : wireshark (RHSA-2012:0509)	Nessus	Red Hat Local Security Checks	2012/4/24	2021/1/14	medium
55008	Fedora 15 : wireshark-1.4.7-1.fc15 (2011-7821)	Nessus	Fedora Local Security Checks	2011/6/9	2021/1/11	medium
55151	Fedora 14 : wireshark-1.4.7-1.fc14 (2011-7846)	Nessus	Fedora Local Security Checks	2011/6/16	2021/1/11	medium
68516	Oracle Linux 6 : wireshark (ELSA-2012-0509)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
57263	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7796)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	high
76045	openSUSE Security Update : wireshark (openSUSE-SU-2011:1142-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
54942	Wireshark < 1.2.17 / 1.4.7 Multiple DoS Vulnerabilities	Nessus	Windows	2011/6/2	2026/3/30	medium
56617	SuSE 10 Security Update : wireshark (ZYPP Patch Number 7795)	Nessus	SuSE Local Security Checks	2011/10/24	2021/1/19	high
61303	Scientific Linux Security Update : wireshark on SL6.x i386/x86_64 (20120423)	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium

检测

插件搜索

medium

high

medium

high

medium

high

critical

medium

medium

medium

medium

medium

high

high

high

medium

high

medium