Wireshark Websocket Dissector 'packet-websocket.c' Denial of Service Vulnerability

Bugtraq ID:	59996
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-3561
Remote:	Yes
Local:	No
Published:	May 17 2013 12:00AM
Updated:	Dec 02 2013 12:47AM
Credit:	Moshe Kaplan
Vulnerable:	SuSE openSUSE 11.4 Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Gentoo Linux
Not Vulnerable:

Wireshark Websocket Dissector 'packet-websocket.c' Denial of Service Vulnerability

Wireshark is prone to a denial-of-service vulnerability because it fails to properly allocate memory.

An attacker can leverage this issue to crash the affected application, denying service to legitimate users.

Wireshark versions 1.8.0 through 1.8.6 are vulnerable.

Wireshark Websocket Dissector 'packet-websocket.c' Denial of Service Vulnerability

A sample packet trace file is available in the Wireshark bug report. Please see the references for more information.
[email protected]

Wireshark Websocket Dissector 'packet-websocket.c' Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Wireshark Websocket Dissector 'packet-websocket.c' Denial of Service Vulnerability

References:

• Wireshark Homepage (Wireshark)