[arch-security] [ASA-201706-9] wireshark-cli: denial of service

[Remi Gacogne]

Arch Linux Security Advisory ASA-201706-9
=========================================

Severity: Low
Date    : 2017-06-12
CVE-ID  : CVE-2017-9343 CVE-2017-9344 CVE-2017-9345 CVE-2017-9346
          CVE-2017-9347 CVE-2017-9348 CVE-2017-9349 CVE-2017-9350
          CVE-2017-9351 CVE-2017-9352 CVE-2017-9353 CVE-2017-9354
Package : wireshark-cli
Type    : denial of service
Remote  : Yes
Link    : https://security.archlinux.org/AVG-287

Summary
=======

The package wireshark-cli before version 2.2.7-1 is vulnerable to
denial of service.

Resolution
==========

Upgrade to 2.2.7-1.

# pacman -Syu "wireshark-cli>=2.2.7-1"

The problems have been fixed upstream in version 2.2.7.

Workaround
==========

None.

Description
===========

- CVE-2017-9343 (denial of service)

An issue has been found in the MSNIP dissector of Wireshark < 2.2.7,
where NULL pointer dereference can be triggered by injecting a
malicious packet into the wire or by convincing someone to read a
malformed packet trace file.

- CVE-2017-9344 (denial of service)

An issue has been found in the BT L2CAP dissector of Wireshark < 2.2.7,
where a division by zero can be triggered by injecting a malicious
packet into the wire or by convincing someone to read a malformed
packet trace file.

- CVE-2017-9345 (denial of service)

An issue has been found in the DNS dissector of Wireshark < 2.2.7,
where an infinite loop can be triggered by injecting a malicious packet
into the wire or by convincing someone to read a malformed packet trace
file.

- CVE-2017-9346 (denial of service)

An issue has been found in the SoulSeek dissector of Wireshark < 2.2.7,
where an infinite loop can be triggered by injecting a malicious packet
into the wire or by convincing someone to read a malformed packet trace
file.

- CVE-2017-9347 (denial of service)

An issue has been found in the ROS dissector of Wireshark < 2.2.7,
where an NULL pointer dereference can be triggered by injecting a
malicious packet into the wire or by convincing someone to read a
malformed packet trace file.

- CVE-2017-9348 (denial of service)

An issue has been found in the DOF dissector of Wireshark < 2.2.7,
where a heap-based out-of-bounds read can be triggered by injecting a
malicious packet into the wire or by convincing someone to read a
malformed packet trace file.

- CVE-2017-9349 (denial of service)

An issue has been found in the DICOM dissector of Wireshark < 2.2.7,
where an infinite loop can be triggered by injecting a malicious packet
into the wire or by convincing someone to read a malformed packet trace
file.

- CVE-2017-9350 (denial of service)

An issue has been found in the openSAFETY dissector of Wireshark <
2.2.7, where an over-sized memory allocation can be triggered by
injecting a malicious packet into the wire or by convincing someone to
read a malformed packet trace file.

- CVE-2017-9351 (denial of service)

An issue has been found in the DHCP dissector of Wireshark < 2.2.7,
where a heap-based out-of-bounds read can be triggered by injecting a
malicious packet into the wire or by convincing someone to read a
malformed packet trace file.

- CVE-2017-9352 (denial of service)

An issue has been found in the bazaar dissector of Wireshark < 2.2.7,
where an infinite loop can be triggered by injecting a malicious packet
into the wire or by convincing someone to read a malformed packet trace
file.

- CVE-2017-9353 (denial of service)

An issue has been found in the IPv6 dissector of Wireshark < 2.2.7,
where a NULL pointer dereference can be triggered by injecting a
malicious packet into the wire or by convincing someone to read a
malformed packet trace file.

- CVE-2017-9354 (denial of service)

An issue has been found in the RGMP dissector of Wireshark < 2.2.7,
where a NULL pointer dereference can be triggered by injecting a
malicious packet into the wire or by convincing someone to read a
malformed packet trace file.

Impact
======

A remote attacker can cause a denial of service by injecting a
malicious packet into the wire or by convincing someone to read a
malformed packet trace file.

References
==========

https://www.wireshark.org/docs/relnotes/wireshark-2.2.7.html
https://www.wireshark.org/security/wnpa-sec-2017-30.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13725
https://www.wireshark.org/security/wnpa-sec-2017-29.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13701
https://www.wireshark.org/security/wnpa-sec-2017-26.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13633
https://www.wireshark.org/security/wnpa-sec-2017-25.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13631
https://www.wireshark.org/security/wnpa-sec-2017-31.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13637
https://www.wireshark.org/security/wnpa-sec-2017-23.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13608
https://www.wireshark.org/security/wnpa-sec-2017-27.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13685
https://www.wireshark.org/security/wnpa-sec-2017-28.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13649
https://www.wireshark.org/security/wnpa-sec-2017-24.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13609
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13628
https://www.wireshark.org/security/wnpa-sec-2017-22.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13599
https://www.wireshark.org/security/wnpa-sec-2017-33.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13675
https://www.wireshark.org/security/wnpa-sec-2017-32.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13646
https://security.archlinux.org/CVE-2017-9343
https://security.archlinux.org/CVE-2017-9344
https://security.archlinux.org/CVE-2017-9345
https://security.archlinux.org/CVE-2017-9346
https://security.archlinux.org/CVE-2017-9347
https://security.archlinux.org/CVE-2017-9348
https://security.archlinux.org/CVE-2017-9349
https://security.archlinux.org/CVE-2017-9350
https://security.archlinux.org/CVE-2017-9351
https://security.archlinux.org/CVE-2017-9352
https://security.archlinux.org/CVE-2017-9353
https://security.archlinux.org/CVE-2017-9354

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20170612/3e68e85d/attachment.asc>