Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2026-3252)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-3252.
##

include('compat.inc');

if (description)
{
  script_id(371862);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/25");

  script_cve_id(
    "CVE-2026-95386",
    "CVE-2026-95387",
    "CVE-2026-95388",
    "CVE-2026-95389",
    "CVE-2026-95390",
    "CVE-2026-95391",
    "CVE-2026-95392",
    "CVE-2026-95393",
    "CVE-2026-95394",
    "CVE-2026-95395",
    "CVE-2026-96415",
    "CVE-2026-96416",
    "CVE-2026-96417",
    "CVE-2026-96418",
    "CVE-2026-96420",
    "CVE-2026-96421",
    "CVE-2026-96422",
    "CVE-2026-96423"
  );

  script_name(english:"Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2026-3252)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3252 advisory.

    TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service (CVE-2026-95386)

    The spdy_assemble_data_frames() function in epan/dissectors/packet-spdy.c accumulates SPDY DATA frame
    payload fragment lengths into a uint32_t variable named datalen without any overflow protection. When the
    total accumulated fragment data exceeds 2^32 bytes (4,294,967,296), the datalen variable wraps to a small
    value. This wrapped value is then passed to wmem_alloc() as the allocation size, producing a buffer
    drastically smaller than the actual data. The subsequent memcpy() calls then write the full ~4.3 GB of
    attacker-controlled fragment data past the end of the tiny allocation, corrupting the heap.
    (CVE-2026-95387)

    Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service (CVE-2026-95388)

    SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
    (CVE-2026-95389)

    The PEAK TRC v1 ERROR-frame parser splits the data column and passes bytes[0] or bytes[1] to
    g_ascii_strtoull() without first validating the token count. A malformed 44-byte file therefore
    dereferences NULL during automatic format detection/read. (CVE-2026-95390)

    ZigBee ZCL Touchlink: empty the commissioning map on a redissect. Wireshark crash by injecting a malformed
    packet onto the wire or by convincing someone to read a malformed packet trace file (CVE-2026-95391)

    The MBIM protocol dissector could crash. Wireshark crash by injecting a malformed packet onto the wire or
    by convincing someone to read a malformed packet trace file. (CVE-2026-95392)

    Heap buffer overflow (WRITE) in CSN.1 dissector -- CSN_RECURSIVE_ARRAY writes past destination array with
    no capacity check (packet-csn1.c). (CVE-2026-95393)

    Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of
    service (CVE-2026-95394)

    The SYNCHROPHASOR dissector (packet-synphasor.c) parses CFG3 configuration frames. The function
    config_3_frame_fast() reads the num_ph (number of phasors) field from the packet without any upper bound
    check, then allocates 17.8 MB of memory using wmem_file_scope() per frame. This memory is only freed when
    the capture file is closed, so sending multiple frames causes memory exhaustion and process termination.A
    single 78-byte UDP packet to port 4713 triggers a 17.8 MB allocation. 1000 frames (~200 KB on disk) cause
    ~17 GB of memory consumption, resulting in OOM kill or g_malloc abort. (CVE-2026-95395)

    Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
    (CVE-2026-96415)

    It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing
    someone to read a malformed packet trace file. The IEEE 802.11 protocol dissector could crash.
    (CVE-2026-96416)

    Wireshark RF4CE Packet Parsing Buffer Overflow Remote Code Execution Vulnerability (CVE-2026-96417)

    dissect_tiff() follows the TIFF Image File Directory (IFD) chain by repeatedly calling dissect_tiff_ifd()
    with the 32-bit next IFD offset it reads verbatim from the input. There is no visited-offset set, no
    requirement that the offset advance, and no iteration cap, so a TIFF whose IFD points its next-IFD field
    back at itself makes the walker loop over the same bytes forever. A bounds exception cannot rescue it,
    because the crafted offset is deliberately in bounds -- the whole PoC is 14 bytes and the IFD it points at
    is the one already being parsed.The dissector is reachable in the default configuration: directly, via the
    default-enabled wtap_file heuristic when a .tif is opened, and from ordinary captured traffic via the
    image/tiff media_type entry (e.g. an HTTP/WSP/MIME body). (CVE-2026-96418)

    Toshiba captures are attacker-controlled text files processed after the handler recognizes the Toshiba
    banner and a packet marker. While searching for the packet OFFSET line, the parser reads into a fixed
    stack buffer with file_gets(), then forcibly truncates the current line at byte 16 and accepts it if the
    prefix equals OFFSET 0001-0203. It then unconditionally parses the packet length from line+64.
    file_gets() only writes the bytes read plus one terminating NUL and does not clear the rest of the buffer,
    so a short line such as OFFSET 0001-0203\n leaves line[64] and following bytes containing
    stale/uninitialized stack contents from previous uses of the buffer. sscanf(line+64, ...) therefore reads
    data that is not part of the current input line, and if no NUL exists in the remaining stack-buffer region
    it may continue past the end of the stack object. A malicious capture can reach this path by providing a
    valid Toshiba header, a valid [No.] record header, and a short OFFSET-prefix line. This is an out-of-
    bounds/stale stack read in an untrusted file parser and can cause undefined behavior or a crash during
    file open/read. (CVE-2026-96420)

    The USB HID dissector reconstructs a device's HID report descriptor from a GET DESCRIPTOR control-transfer
    response and parses it in parse_report_descriptor(). When the descriptor declares a Usage Minimum / Usage
    Maximum pair, the dissector expands the inclusive range into a wmem array with for (uint32_t j =
    usage_min; j <= usage_max; j++). Both bounds come straight from the capture, and HID extended usage
    items carry a full 4-byte usage value, so usage_max can be 0xFFFFFFFF. At that point j++ wraps 0xFFFFFFFF
    -> 0, the j <= usage_max test is unconditionally true, and the loop never terminates while appending 4
    bytes per iteration to a file-scoped wmem array -- an infinite loop that also grows the heap without
    bound. (CVE-2026-96421)

    A syntactically valid pcapng file containing many repeated packet-comment options can abort TShark when it
    builds the full protocol tree with -V. Wireshark renders every comment before entering the frame
    dissector's exception boundary. The normal one-million-tree-item safeguard consequently raises an uncaught
    DissectorError, terminating the process instead of reporting a bounded per-packet dissection error.The
    Frame protocol metadissector could crash. (CVE-2026-96422)

    The X11 dissector caches, per TCP conversation, one keysym array per keycode in
    x11_conv_data_t.keycodemap[256]. Each array is allocated in listOfKeysyms() with the keysyms-per-keycode
    width in force for the message being dissected, but the dissector records only a single scalar
    state->keysyms_per_keycode, with no per-array width. The X_ChangeKeyboardMapping request writes entries
    with a request-local width and leaves the scalar untouched; the X_GetKeyboardMapping reply sets the
    scalar. The two therefore diverge. When a later KeyPress/KeyRelease event is dissected,
    keycode2keysymString() indexes the cached arrays with the current scalar and never consults each array's
    real length, so any array allocated narrower than the scalar is read out of bounds. This is reachable from
    a capture with the default configuration (the X11 dissector is registered on TCP 6000-6063 and enabled by
    default; no protocol preference or key is required). (CVE-2026-96423)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-3252.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-95386.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-95387.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-95388.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-95389.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-95390.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-95391.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-95392.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-95393.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-95394.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-95395.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-96415.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-96416.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-96417.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-96418.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-96420.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-96421.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-96422.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-96423.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update wireshark --releasever 2023.12.20261026' or
  or 'dnf update --advisory ALAS2023-2026-3252 --releasever 2023.12.20261026' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-95395");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-95387");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:wireshark-cli");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:wireshark-cli-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:wireshark-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:wireshark-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'wireshark-cli-4.6.9-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'wireshark-cli-4.6.9-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'wireshark-cli-debuginfo-4.6.9-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'wireshark-cli-debuginfo-4.6.9-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'wireshark-debugsource-4.6.9-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'wireshark-debugsource-4.6.9-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'wireshark-devel-4.6.9-1.amzn2023.0.2', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'wireshark-devel-4.6.9-1.amzn2023.0.2', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "wireshark-cli / wireshark-cli-debuginfo / wireshark-debugsource / etc");
}