Wireshark Multiple Denial of Service Vulnerabilities

Bugtraq ID:	106051
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2018-19622 CVE-2018-19623 CVE-2018-19624 CVE-2018-19625 CVE-2018-19626 CVE-2018-19627 CVE-2018-19628
Remote:	Yes
Local:	No
Published:	Nov 28 2018 12:00AM
Updated:	Nov 28 2018 12:00AM
Credit:	Mateusz Jurczyk, Otto Airamo and Antti Levomäki, Forcepoint, and Kamil Frankowicz
Vulnerable:	Wireshark Wireshark 2.6.4 Wireshark Wireshark 2.6.3 Wireshark Wireshark 2.6.2 Wireshark Wireshark 2.6.1 Wireshark Wireshark 2.6 Wireshark Wireshark 2.4.10 Wireshark Wireshark 2.4.9 Wireshark Wireshark 2.4.8 Wireshark Wireshark 2.4.7 Wireshark Wireshark 2.4.6 Wireshark Wireshark 2.4.5 Wireshark Wireshark 2.4.4 Wireshark Wireshark 2.4.3 Wireshark Wireshark 2.4.1 Wireshark Wireshark 2.4 Wireshark Wireshark 2.4.2
Not Vulnerable:	Wireshark Wireshark 2.6.5 Wireshark Wireshark 2.4.11

Wireshark Multiple Denial of Service Vulnerabilities

Wireshark is prone to multiple denial-of-service vulnerabilities.

An attacker can exploit these issues by injecting a malformed packet onto the wire or by convincing someone to read a malformed 'pcap' file.

Attackers can exploit these issues to crash the affected application or to consume excess memory, denying service to legitimate users.

Wireshark Multiple Denial of Service Vulnerabilities

Sample packet trace files are available in the Wireshark bug reports. Please see the references for more information.

Wireshark Multiple Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Wireshark Multiple Denial of Service Vulnerabilities

References:

• DCOM: always NUL-terminate dissect_dcom_BSTR results (Wireshark)
  
• IxVeriWave: Fix a buffer boundary. (Wireshark)
  
• LBMPDM: fix heap-buffer-overflow (write) in dissect_segment_ofstable (Wireshark)
  
• MMSE: catch length overflows to avoid infinite loop. (Wireshark)
  
• pvfs2: Add a pointer check. (Wireshark)
  
• tvbuff_composite: fix buffer overflow due to wrong offset adjustment (Wireshark)
  
• ZigBee ZCL: Fix a divide-by-zero. (Wireshark)
  
• Wireshark Homepage (Wireshark)
  
• Bug 14466 - Crafted H.225 packets causing read heap-buffer-overflow (Wireshark)
  
• Bug 15132 - Invalid write in dissect_segment_ofstable() (Wireshark)
  
• Bug 15250 - Buildbot crash output: fuzz-2018-10-30-17730.pcap (Wireshark)
  
• Bug 15279 - Wireshark heap out-of-bounds read in find_signature (Wireshark)
  
• Bug 15280 - Wireshark SIGSEGV in dissect_pvfs2_getconfig_response (Wireshark)
  
• Bug 15281 - Wireshark div-by-zero crash in decode_color_temperature (Wireshark)
  
• Bug 15130 - Buildbot crash output: fuzz-2018-09-10-4123.pcap (Wireshark)
  
• Oracle Solaris Third Party Bulletin - January 2019 (Oracle)
  
• wnpa-sec-2018-51 · Wireshark dissection engine crash (Wireshark)
  
• wnpa-sec-2018-52 · DCOM dissector crash (Wireshark)
  
• wnpa-sec-2018-53 · LBMPDM dissector crash (Wireshark)
  
• wnpa-sec-2018-54 · MMSE dissector infinite loop (Wireshark)
  
• wnpa-sec-2018-55 · IxVeriWave file parser crash. (Wireshark)
  
• wnpa-sec-2018-56 · PVFS dissector crash (Wireshark)
  
• wnpa-sec-2018-57 · ZigBee ZCL dissector crash (Wireshark)