Arch Linux Security Advisory ASA-201505-11 ========================================== Severity: Medium Date : 2015-05-15 CVE-ID : CVE-2015-3808 CVE-2015-3809 CVE-2015-3810 CVE-2015-3811 CVE-2015-3812 CVE-2015-3813 CVE-2015-3814 CVE-2015-3815 Package : wireshark-qt Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-qt before version 1.12.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.12.5-1. # pacman -Syu "wireshark-qt>=1.12.5-1" The problems have been fixed upstream in version 1.12.5. Workaround ========== None. Description =========== - CVE-2015-3808 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3809 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3810 (denial of service) The Websocket dissector recurses to dissect more data. Since the minimum valid websocket frame length is two bytes, this allows for quite some recursion. With a minimal IP and TCP header (20 bytes each), you can get 32747 recursions which is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3811 (denial of service) The WCP dissector could crash while decompressing data. The compression format is basically saying "these n bytes are the same as these other n bytes you've already seen at offset X" except we haven't processed X bytes yet so we're not validating that offset and are getting uninitialized bytes leading to a crash when injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3812 (denial of service) It has been discovered that the X11 dissector could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3813 (denial of service) It has been discovered that the packet reassembly code could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3814 (denial of service) It has been discovered that the IEEE 802.11 dissector could go into an infinite loop under certain circumstances. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3815 (denial of service) It has been discovered that the Android Logcat file parser could crash under certain circumstances. This issue is leading to denial of service by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker is able to perform a denial of service attack by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file via various vectors. References ========== https://wireshark.org/docs/relnotes/wireshark-1.12.5.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3808 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3809 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3810 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3811 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3812 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3813 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3814 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3815