wnpa-sec-2011-06 · DECT, NFS, and X.509if vulnerabilities in Wireshark
Summary
Name: DECT, NFS, and X.509if vulnerabilities in Wireshark
Docid: wnpa-sec-2011-06
Date: April 15, 2011
Affected versions: 1.4.0
Fixed versions: 1.4.5
Details
Description
Wireshark 1.4.5 fixes the following vulnerabilities:
-
The NFS dissector could crash on Windows.
(Bug
5209)
Versions affected: 1.4.0 to 1.4.4. -
The X.509if dissector could crash.
(Bug
5754,
Bug
5793)
Versions affected: 1.2.0 to 1.2.15 and 1.4.0 to 1.4.4. -
Paul Makowski from SEI/CERT discovered that the DECT dissector could
overflow a buffer. He verified that this could allow remote code
execution on many platforms.
Versions affected: 1.4.0 to 1.4.4.
Impact
It may be possible to make Wireshark crash by injecting a series of malformed packets onto the wire or by convincing someone to read a malformed packet trace file.
Resolution
Upgrade to Wireshark 1.4.5 or later.
If are running Wireshark {{ end_version }} or earlier (including Ethereal) and cannot upgrade, you can work around the problem listed above by doing the following:
- Disable the DECT, NFS (if you're running Windows), and X.509if dissectors:
- Select Analyze→Enabled Protocols... from the menu.
- Make sure "DECT", "NFS", and "X.509if" are un-checked.
- Click "Save", then click "OK".