LWN.net Logo

wireshark: multiple vulnerabilities

Package(s):wireshark CVE #(s):CVE-2013-4074 CVE-2013-4081 CVE-2013-4083
Created:June 12, 2013 Updated:September 30, 2013
Description: From the CVE entries:

The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 incorrectly uses a -1 data value to represent an error condition, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. (CVE-2013-4074)

The http_payload_subdissector function in epan/dissectors/packet-http.c in the HTTP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 does not properly determine when to use a recursive approach, which allows remote attackers to cause a denial of service (stack consumption) via a crafted packet. (CVE-2013-4081)

The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.6.x before 1.6.16, 1.8.x before 1.8.8, and 1.10.0 does not validate a certain fragment length value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. (CVE-2013-4083)

Alerts:
Mandriva MDVSA-2013:172 2013-06-12
Debian DSA-2709-1 2013-06-17
Mageia MGASA-2013-0180 2013-06-26
Mageia MGASA-2013-0181 2013-06-26
Gentoo 201308-05 2013-08-28
Gentoo GLSA 201308-05:02 2013-08-30
Fedora FEDORA-2013-17661 2013-09-28

(Log in to post comments)

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds