Changes in wireshark :

  - update to 1.4.12

  - fix bnc#754474, bnc#754476, bnc#754477(fixed upstream)

  - Security fixes :

  - wnpa-sec-2012-04 The ANSI A dissector could dereference     a NULL pointer and crash. (Bug 6823)

  - wnpa-sec-2012-06 The pcap and pcap-ng file parsers could     crash trying to read ERF data. (Bug 6804)

  - wnpa-sec-2012-07 The MP2T dissector could try to     allocate too much memory and crash. (Bug 6804)

  - The Windows installers now include GnuTLS 1.12.18, which     fixes several vulnerabilities.

  - Bug fixes :

  - Some PGM options are not parsed correctly. (Bug 5687)

  - dumpcap crashes when capturing from pipe to a pcap-ng     file (e.g., when passing data from CACE Pilot to     Wireshark). (Bug 5939)

  - No error for UDP/IPv6 packet with zero checksum. (Bug     6232)

  - packetBB dissector bug: More than 1000000 items in the     tree -- possible infinite loop. (Bug 6687)

  - Ethernet traces in K12 text format sometimes give bogus     'malformed frame' errors and other problems. (Bug 6735)

  - non-IPP packets to or from port 631 are dissected as     IPP. (Bug 6765)

  - IAX2 dissector reads past end of packet for unknown IEs.
    (Bug 6815)

  - Pcap-NG files with SHB options longer than 100 bytes     aren't recognized as pcap-NG files, and options longer     than 100 bytes in other blocks aren't handled either.
    (Bug 6846)

  - Patch to fix DTLS decryption. (Bug 6847)

  - Expression... dialog is crash. (Bug 6891)

  - ISAKMP : VendorID CheckPoint : Malformed Packet. (Bug     6972)

  - Radiotap dissector lists a bogus 'DBM TX Attenuation'     bit. (Bug 7000)

  - MySQL dissector assertion. (Ask 8649) Updated Protocol     Support HTTP, ISAKMP, MySQL, PacketBB, PGM, TCP, UDP New     and Updated Capture File Support Endace ERF, Pcap-NG.

The remote Solaris system is missing necessary patches to address security updates :

  - epan/dissectors/packet-ansi_a.c in the ANSI A dissector     in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6     allows remote attackers to cause a denial of service     (NULL pointer dereference and application crash) via a     malformed packet. (CVE-2012-1593)

  - epan/dissectors/packet-ieee80211.c in the IEEE 802.11     dissector in Wireshark 1.6.x before 1.6.6 allows remote     attackers to cause a denial of service (infinite loop)     via a crafted packet. (CVE-2012-1594)

  - The pcap_process_pseudo_header function in     wiretap/pcap-common.c in Wireshark 1.4.x before 1.4.12     and 1.6.x before 1.6.6 allows remote attackers to cause     a denial of service (application crash) via a     WTAP_ENCAP_ERF file containing an Extension or     Multi-Channel header with an invalid pseudoheader size,     related to the pcap and pcap-ng file parsers.
    (CVE-2012-1595)

  - The mp2t_process_fragmented_payload function in     epan/dissectors/packet-mp2t.c in the MP2T dissector in     Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6     allows remote attackers to cause a denial of service     (application crash) via a packet containing an invalid     pointer value that triggers an incorrect     memory-allocation attempt. (CVE-2012-1596)

This version upgrade of wireshark fixes the following security vulnerabilities :

  - The ANSI A dissector could dereference a NULL pointer     and crash. (CVE-2012-1593)

  - The pcap and pcap-ng file parsers could crash trying to     read ERF data. (CVE-2012-1595)

  - The MP2T dissector could try to allocate too much memory     and crash. (CVE-2012-1596) Additionally, various other     non-security bugs have been fixed.

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark.
(CVE-2011-1590, CVE-2011-4102, CVE-2012-1595)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2011-1143, CVE-2011-1957, CVE-2011-1958, CVE-2011-1959, CVE-2011-2174, CVE-2011-2175, CVE-2011-2597, CVE-2011-2698, CVE-2012-0041, CVE-2012-0042, CVE-2012-0067, CVE-2012-0066)

Users of Wireshark should upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2012-539:02 advisory.

    Wireshark is a network traffic analyzer for Unix-ish operating systems.
    This package lays base for libpcap, a packet capture and filtering library, contains command-line     utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged     separately to GTK+ package.
    Security issues fixed with this release:
     CVE-2011-1143     epan/dissectors/packet-ntlmssp.c in the NTLMSSP dissector in Wireshark before 1.4.4 allows remote     attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted     .pcap file.
     CVE-2011-1590     The X.509if dissector in Wireshark 1.2.x before 1.2.16 and 1.4.x before 1.4.5 does not properly initialize     certain global variables, which allows remote attackers to cause a denial of service (application crash)     via a crafted .pcap file.
     CVE-2011-1957     The dissect_dcm_main function in epan/dissectors/packet-dcm.c in the DICOM dissector in Wireshark 1.2.x     before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (infinite loop)     via an invalid PDU length.
     CVE-2011-1958     Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows user-assisted remote attackers to cause a     denial of service (NULL pointer dereference and application crash) via a crafted Diameter dictionary file.
     CVE-2011-1959     The snoop_read function in wiretap/snoop.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 does     not properly handle certain virtualizable buffers, which allows remote attackers to cause a denial of     service (application crash) via a large length value in a snoop file that triggers a stack-based buffer     over-read.
     CVE-2011-2174     Double free vulnerability in the tvb_uncompress function in epan/tvbuff.c in Wireshark 1.2.x before 1.2.17     and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a     packet with malformed data that uses zlib compression.
     CVE-2011-2175     Integer underflow in the visual_read function in wiretap/visual.c in Wireshark 1.2.x before 1.2.17 and     1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a     malformed Visual Networks file that triggers a heap-based buffer over-read.
     CVE-2011-2597     The Lucent/Ascend file parser in Wireshark 1.2.x before 1.2.18, 1.4.x through 1.4.7, and 1.6.0 allows     remote attackers to cause a denial of service (infinite loop) via malformed packets.
     CVE-2011-2698     Off-by-one error in the elem_cell_id_aux function in epan/dissectors/packet-ansi_a.c in the ANSI MAP     dissector in Wireshark 1.4.x before 1.4.8 and 1.6.x before 1.6.1 allows remote attackers to cause a denial     of service (infinite loop) via an invalid packet.
     CVE-2011-4102     Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file parser in     Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service     (application crash) via a malformed file.
     CVE-2012-0041     The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5     allows remote attackers to cause a denial of service (application crash) via a long packet in a capture     file, as demonstrated by an airopeek file.
     CVE-2012-0042     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions,     which allows remote attackers to cause a denial of service (NULL pointer dereference and application     crash) via a crafted packet, related to epan/to_str.c.
     CVE-2012-0066     Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service     (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or     (3) NETMON 2 capture file.
     CVE-2012-0067     wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause     a denial of service (application crash) via a long packet in an AIX iptrace file.
     CVE-2012-1595     The pcap_process_pseudo_header function in wiretap/pcap-common.c in Wireshark 1.4.x before 1.4.12 and     1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a     WTAP_ENCAP_ERF file containing an Extension or Multi-Channel header with an invalid pseudoheader size,     related to the pcap and pcap-ng file parsers.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
74610	openSUSE Security Update : wireshark (openSUSE-SU-2012:0558-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
80802	Oracle Solaris Third-Party Patch Update : wireshark (multiple_vulnerabilities_in_wireshark)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
58944	SuSE 11.1 Security Update : wireshark (SAT Patch Number 6170)	Nessus	SuSE Local Security Checks	2012/5/1	2021/1/19	medium
58841	RHEL 6 : wireshark (RHSA-2012:0509)	Nessus	Red Hat Local Security Checks	2012/4/24	2021/1/14	medium
283972	MiracleLinux 4 : wireshark-1.2.15-2.AXS4.1 (AXSA:2012-539:02)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	high
58849	CentOS 6 : wireshark (CESA-2012:0509)	Nessus	CentOS Local Security Checks	2012/4/25	2021/1/4	medium

检测

插件搜索

medium

medium

medium

medium

high

medium