wnpa-sec-2010-14 · LDSS and ZigBee ZCL vulnerabilities in Wireshark
Summary
Name: LDSS and ZigBee ZCL vulnerabilities in Wireshark
Docid: wnpa-sec-2010-14
Date: November 18, 2010
Affected versions: 1.4.0
Fixed versions: 1.4.2
Details
Description
Wireshark 1.4.2 fixes the following vulnerability:
- Nephi Johnson of BreakingPoint discovered that the LDSS dissector could overflow a buffer. (Bug 5318) Versions affected: 1.2.0 to 1.2.12 and 1.4.0 to 1.4.1. CVE-2010-4300
- The ZigBee ZCL dissector could go into an infinite loop. (Bug 5303) Versions affected: 1.4.0 to 1.4.1. CVE-2010-4301
Impact
It may be possible to make Wireshark crash by injecting a series of malformed packets onto the wire or by convincing someone to read a malformed packet trace file.
Resolution
Upgrade to Wireshark 1.4.2 or later.
If are running Wireshark {{ end_version }} or earlier (including Ethereal) and cannot upgrade, you can work around each of the problems listed above by doing the following:
- Disable the LDSS and ZigBee ZCL dissectors:
- Select Analyze→Enabled Protocols... from the menu.
- Make sure "LDSS" and "ZigBee ZCL" are un-checked.
- Click "Save", then click "OK".