[arch-security] [ASA-201505-12] wireshark-gtk: denial of service

[Levente Polyak]

Arch Linux Security Advisory ASA-201505-12
==========================================

Severity: Medium
Date    : 2015-05-15
CVE-ID  : CVE-2015-3808 CVE-2015-3809 CVE-2015-3810 CVE-2015-3811
          CVE-2015-3812 CVE-2015-3813 CVE-2015-3814 CVE-2015-3815
Package : wireshark-gtk
Type    : denial of service
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package wireshark-gtk before version 1.12.5-1 is vulnerable to
denial of service.

Resolution
==========

Upgrade to 1.12.5-1.

# pacman -Syu "wireshark-gtk>=1.12.5-1"

The problems have been fixed upstream in version 1.12.5.

Workaround
==========

None.

Description
===========

- CVE-2015-3808 (denial of service)

There is an infinite loop condition in dissect_lbmr_pser() in
epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the
the variable 'option_len' to 0, causing the loop to never terminate.
This issue is leading to excessive CPU resources consumption by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.

- CVE-2015-3809 (denial of service)

There is an infinite loop condition in dissect_lbmr_pser() in
epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the
the variable 'option_len' to 0, causing the loop to never terminate.
This issue is leading to excessive CPU resources consumption by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.

- CVE-2015-3810 (denial of service)

The Websocket dissector recurses to dissect more data. Since the minimum
valid websocket frame length is two bytes, this allows for quite some
recursion. With a minimal IP and TCP header (20 bytes each), you can get
32747 recursions which is leading to excessive CPU resources consumption
by injecting a malformed packet onto the wire or by convincing someone
to read a malformed packet trace file.

- CVE-2015-3811 (denial of service)

The WCP dissector could crash while decompressing data. The compression
format is basically saying "these n bytes are the same as these other n
bytes you've already seen at offset X" except we haven't processed X
bytes yet so we're not validating that offset and are getting
uninitialized bytes leading to a crash when injecting a malformed packet
onto the wire or by convincing someone to read a malformed packet trace
file.

- CVE-2015-3812 (denial of service)

It has been discovered that the X11 dissector could leak memory under
certain circumstances. This may lead to crash by excessive memory
consumption via injecting malformed packets onto the wire or by
convincing someone to read a malformed packet trace file.

- CVE-2015-3813 (denial of service)

It has been discovered that the packet reassembly code could leak memory
under certain circumstances. This may lead to crash by excessive memory
consumption via injecting malformed packets onto the wire or by
convincing someone to read a malformed packet trace file.

- CVE-2015-3814 (denial of service)

It has been discovered that the IEEE 802.11 dissector could go into an
infinite loop under certain circumstances. This issue is leading to
excessive CPU resources consumption by injecting a malformed packet onto
the wire or by convincing someone to read a malformed packet trace file.

- CVE-2015-3815 (denial of service)

It has been discovered that the Android Logcat file parser could crash
under certain circumstances. This issue is leading to denial of service
by injecting a malformed packet onto the wire or by convincing someone
to read a malformed packet trace file.

Impact
======

A remote attacker is able to perform a denial of service attack by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file via various vectors.

References
==========

https://wireshark.org/docs/relnotes/wireshark-1.12.5.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3808
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3809
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3810
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3811
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3812
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3813
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3814
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3815

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20150515/8268fe31/attachment-0001.asc>