Beers with Talos Ep. #38 — More fun with VPNFilter; Getting pwnd via spreadsheet

Beers with Talos BWT Podcast Ep. 38 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Ep. 38 show notes: Recorded Sept. 21, 2018 — The whole crew is back together! On the agenda today is VPNFilter part III, now...

Security update for wireshark (moderate)

This update for wireshark to version 2.4.9 fixes the following issues: Security issues fixed bsc1106514: - CVE-2018-16058: Bluetooth AVDTP dissector crash wnpa-sec-2018-44 - CVE-2018-16056: Bluetooth Attribute Protocol dissector crash wnpa-sec-2018-45 - CVE-2018-16057: Radiotap dissector crash...

CVE-2018-14370

In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/airpdcap.c via bounds checking that prevents a buffer over-read...

Wireshark Security Updates (wnpa-sec-2018-34_wnpa-sec-2018-41) - Mac OS X

Wireshark is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"; ifdescripti...

CVE-2018-14370

In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/airpdcap.c via bounds checking that prevents a buffer over-read...

CVE-2018-14370

In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/airpdcap.c via bounds checking that prevents a buffer over-read...

CVE-2018-14370

In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/airpdcap.c via bounds checking that prevents a buffer over-read...

CVE-2018-14342

CVE-2018-14342 affects Wireshark/BGP dissector: in Wireshark versions 2.6.0–2.6.1, 2.4.0–2.4.7, and 2.2.0–2.2.15, the BGP protocol dissector could loop excessively due to insufficient validation of Path Attribute lengths. The issue was addressed in epan/dissectors/packet-bgp.c by validating Path ...

CVE-2018-14368

In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the Bazaar protocol dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-bzr.c by properly handling items that are too long...

Wireshark infinite loop vulnerability (CNVD-2018-14108)

Wireshark formerly Ethereal is a suite of network packet analysis software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis.MMSE dissector is one of the MMSE protocol parsers. A security vulnerability exists in th...

CVE-2018-11361

In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/dot11decrypt.c by avoiding a buffer overflow during FTE processing in Dot11DecryptTDLSDeriveKey...

CVE-2018-11361

In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/dot11decrypt.c by avoiding a buffer overflow during FTE processing in Dot11DecryptTDLSDeriveKey...

Buffer overflow

In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/dot11decrypt.c by avoiding a buffer overflow during FTE processing in Dot11DecryptTDLSDeriveKey...

CVE-2018-11361

Wireshark CVE-2018-11361 affects the IEEE 802.11 dissector in version 2.6.0, where a buffer overflow could occur during FTE processing in Dot11DecryptTDLSDeriveKey, leading to a crash. The issue was addressed in the code path epan/crypt/dot11decrypt.c to avoid the overflow, and downstream advisor...

Wireshark epan/dissectors/packet-pcp.c file memory leak vulnerability

Wireshark formerly known as Ethereal is a network packet analyzer software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A security vulnerability exists in the epan/dissectors/packet-pcp.c file in Wireshark...

CVE-2018-7320

In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the SIGCOMP protocol dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by validating operand offsets...

CVE-2018-7320

Wireshark SIGCOMP dissector vulnerability CVE-2018-7320: affected Wireshark 2.4.0–2.4.4 and 2.2.0–2.2.12; crash caused by missing validation of operand offsets in packet-sigcomp.c. Exploitation via malformed packets may crash the dissector; no explicit exploitation details provided. The issue is ...

Wireshark WCP Parser Denial of Service Vulnerability

Wireshark formerly known as Ethereal is a suite of network packet analysis software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis.WCP dissector is one of the WCP protocol parsers. A denial of service...

DEBIAN-CVE-2018-5335

In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the WCP dissector could crash. This was addressed in epan/dissectors/packet-wcp.c by validating the available buffer length...

Wireshark WSP Dissector 'packet-wsp.c' Infinite Loop Denial of Service Vulnerability

Wireshark formerly known as Ethereal is a network packet analyzer software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. Wireshark WSP Dissector 'packet-wsp.c' has an infinite loop denial of service...