Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/

SYNTHESIS OF THE VULNERABILITY

Several vulnerabilities of Wireshark can be used by a remote
attacker to create a denial of service or to execute code.

Severity: 2/4

Creation date: 22/11/2010

DESCRIPTION OF THE VULNERABILITY

The Wireshark program captures and displays network packets.
Protocols are decoded by dissectors. They are impacted by several
vulnerabilities.

The LDSS (Local Download Sharing Service) protocol is used to
transfer documents. An attacker can send a malicious LDSS Transfer
packet, in order to create a buffer overflow in the
dissect_ldss_transfer() function of the LDSS. [severity:2/4; 5318,
BID-44987, CVE-2010-4300]

The ZigBee protocol is used for radio communications. An attacker
can send a ZCL (ZigBee Cluster Library) packet of type Discover
Attributes Response with a null "tree" field, in order to generate
an infinite loop in the ZigBee ZCL dissector. [severity:1/4; 5303,
BID-44986, CVE-2010-4301]

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/Wireshark-two-vulnerabilities-10141