Wireshark Endace ERF unsigned integer wrap vulnerability

Overview

Wireshark contains an unsigned integer wrap vulnerability that may occur when parsing Endace Extensible Record Format (ERF) files.

Description

Wireshark is a protocol analyzer that can open or import previously saved files. When processing an Endace ERF file an unsigned integer wrap vulnerability may cause Wireshark to allocate a very large buffer. To exploit this issue, an attacker would have to convince a user to open a crafted ERF file using Wireshark.

This issue also affects Tshark, the console version of Wireshark.

---

Impact

A remote attacker can cause Wireshark to crash. It may be possible, although unlikely, for an attacker to execute arbitrary code. Exploiting the vulnerability could result in a NULL pointer dereference, which can lead to code execution on certain platforms.

---

Solution

Update
Wireshark 1.2.2 has been released to address this and other issues.

---

Do not run Wireshark with root or administrator privileges

Running Wireshark with a limited user account will reduce the impact of this and other vulnerabilities.

---

Vendor Information

676492

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Wireshark Affected

Updated: October 05, 2009

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References

• <http://www.wireshark.org/docs/relnotes/wireshark-1.2.2.html&gt;
• http://anonsvn.wireshark.org/viewvc/trunk/wiretap/erf.c?view=markup&pathrev=29364

CVSS Metrics

Group	Score	Vector
Base	0	AV:–/AC:–/Au:–/C:–/I:–/A:–
Temporal	0	E:Not Defined (ND)/RL:Not Defined (ND)/RC:Not Defined (ND)
Environmental	0	CDP:Not Defined (ND)/TD:Not Defined (ND)/CR:Not Defined (ND)/IR:Not Defined (ND)/AR:Not Defined (ND)

References

• <http://www.wireshark.org/docs/relnotes/wireshark-1.2.2.html&gt;
• http://anonsvn.wireshark.org/viewvc/trunk/wiretap/erf.c?view=markup&pathrev=29364
• <https://www.securecoding.cert.org/confluence/display/cplusplus/INT30-CPP.+Ensure+that+unsigned+integer+operations+do+not+wrap&gt;
• <http://wiki.wireshark.org/Security#head-ac69042aeeb98cdaed2ec2ff1bd2c983fa03cffd&gt;
• <http://xorl.wordpress.com/2009/11/10/cve-2009-3829-wireshark-endace-erf-protocol-integer-underflow/&gt;
• <http://www.juniper.net/solutions/literature/white_papers/Vector-Rewrite-Attack.pdf&gt;

Acknowledgements

This issue was discovered by Ryan Giobbi.

This document was written by Ryan Giobbi and Art Manion.

Other Information

CVE IDs:	None
Severity Metric:	1.28 Date Public: