Wireshark (Ethereal) Bugs in HTTP, LDAP, XOT, WBXML, and MIME Multipart Dissectors Let Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1017129
|
|
SecurityTracker URL: http://securitytracker.com/id?1017129
|
|
CVE Reference: CVE-2006-4574
, CVE-2006-4805
, CVE-2006-5468
, CVE-2006-5469
, CVE-2006-5740
(Links to External Site)
|
Date: Oct 27 2006
|
Impact: Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 0.9.8 up to and including 0.99.3
|
Description: Several vulnerabilities were reported in Wireshark (Ethereal). A remote user can cause denial of service conditions.
A remote user can send specially crafted data to cause the target service to crash or consume excessive memory.
The HTTP, LDAP,
XOT, WBXML, and MIME Multipart dissectors are affected. Also, the parsing of WEP keys (when AirPcap support is enabled) is affected.
|
Impact: A remote user can cause Wireshark to crash.
|
Solution: The vendor has issued a fixed version (0.99.4), available at:
http://www.wireshark.org/download.html
The Wireshark advisory is available at:
http://www.wireshark.org/security/wnpa-sec-2006-03.html
|
Vendor URL: www.wireshark.org/security/wnpa-sec-2006-03.html (Links to External Site)
|
Cause: Exception handling error, Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Fri, 27 Oct 2006 08:09:14 -0400
Subject: Multiple problems in Wireshark (formerly Ethereal ) versions 0.9.8 to 0.99.3
|
http://www.wireshark.org/security/wnpa-sec-2006-03.html
CVE-2006-4574
CVE-2006-4805
CVE-2006-5468
CVE-2006-5469
CVE-2006-5740
|
|
