wireshark-gtk: denial of service

2015-05-15T00:00:00
ID ASA-201505-12
Type archlinux
Reporter Arch Linux
Modified 2015-05-15T00:00:00

Description

  • CVE-2015-3808 (denial of service)

There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

  • CVE-2015-3809 (denial of service)

There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

  • CVE-2015-3810 (denial of service)

The Websocket dissector recurses to dissect more data. Since the minimum valid websocket frame length is two bytes, this allows for quite some recursion. With a minimal IP and TCP header (20 bytes each), you can get 32747 recursions which is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

  • CVE-2015-3811 (denial of service)

The WCP dissector could crash while decompressing data. The compression format is basically saying "these n bytes are the same as these other n bytes you've already seen at offset X" except we haven't processed X bytes yet so we're not validating that offset and are getting uninitialized bytes leading to a crash when injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

  • CVE-2015-3812 (denial of service)

It has been discovered that the X11 dissector could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file.

  • CVE-2015-3813 (denial of service)

It has been discovered that the packet reassembly code could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file.

  • CVE-2015-3814 (denial of service)

It has been discovered that the IEEE 802.11 dissector could go into an infinite loop under certain circumstances. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

  • CVE-2015-3815 (denial of service)

It has been discovered that the Android Logcat file parser could crash under certain circumstances. This issue is leading to denial of service by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.