Wireshark GSM CBCH Dissector Denial of Service Vulnerability

Bugtraq ID:	60498
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-4079
Remote:	Yes
Local:	No
Published:	Jun 10 2013 12:00AM
Updated:	Apr 13 2015 09:34PM
Credit:	Laurent Butti
Vulnerable:	Wireshark Wireshark 1.8.7 Wireshark Wireshark 1.8.6 Wireshark Wireshark 1.8.5 Wireshark Wireshark 1.8.4 Wireshark Wireshark 1.8.3 Wireshark Wireshark 1.8.2 Wireshark Wireshark 1.8.1 Wireshark Wireshark 1.8.0 Gentoo Linux
Not Vulnerable:	Wireshark Wireshark 1.8.8

Wireshark GSM CBCH Dissector Denial of Service Vulnerability

Wireshark is prone to a denial-of-service vulnerability because it fails to properly allocate memory.

An attacker can leverage this issue to crash the affected application, denying service to legitimate users.

Wireshark versions 1.8.0 through 1.8.7 are vulnerable.

Note: This issue was previously discussed in BID 60448 (Wireshark Multiple Buffer Overflow and Denial of Service), but has been moved to its own record for better documentation.

Wireshark GSM CBCH Dissector Denial of Service Vulnerability

A sample packet trace file is available in the Wireshark bug report. Please see the references for more information.
[email protected]

Wireshark GSM CBCH Dissector Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Wireshark GSM CBCH Dissector Denial of Service Vulnerability

References:

• Bug 8730 - GSM_CBCH dissector hangs (Wireshark)
  
• Wireshark 1.8.8 Release Notes (Wireshark)
  
• Wireshark Homepage (Wireshark)