Actu
Vigil@nce: Wireshark, denials of service
December 2008 by Vigil@nce
Several vulnerabilities of Wireshark can be used by a remote
attacker to create a denial of service.
– Gravity: 1/4
– Consequences: denial of service of service
– Provenance: intranet client
– Means of attack: no proof of concept, no attack
– Ability of attacker: expert (4/4)
– Confidence: confirmed by the editor (5/5)
– Diffusion of the vulnerable configuration: high (3/3)
– Number of vulnerabilities in this bulletin: 2
– Creation date: 11/12/2008
IMPACTED PRODUCTS
– Unix - plateform
DESCRIPTION
The Wireshark/Ethereal program captures packets, in order to help
administrator solving network problems. Protocols are decoded by
dissectors. They have several vulnerabilities.
When a SMTP query contains long data, a denial of service occurs.
[grav:1/4; BID-32422, CVE-2008-5285, SVRT-04-08]
An attacker can create an infinite loop in the WLCCP dissector.
[grav:1/4]
CHARACTERISTICS
– Identifiers: BID-32422, CVE-2008-5285, SVRT-04-08,
VIGILANCE-VUL-8324, wnpa-sec-2008-07
– Url: http://vigilance.fr/vulnerability/8324
