Bug 470262 – <net-analyzer/wireshark-{1.6.15,1.8.7} - multiple vulnerabilities (CVE-2013-{3555,3556,3557,3558,3559,3560,3561,3562})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Jeroen Roovers (RETIRED) 2013-05-18 14:38:55 UTC]

http://www.wireshark.org/docs/relnotes/wireshark-1.6.15.html
http://www.wireshark.org/docs/relnotes/wireshark-1.8.7.html

[Comment 1 Jeroen Roovers (RETIRED) 2013-05-18 15:10:36 UTC]

Arch teams, please test and mark stable:
=net-analyzer/wireshark-1.6.15
=net-analyzer/wireshark-1.8.7
Stable KEYWORDS : alpha amd64 hppa ia64 ppc ppc64 sparc x86

[Comment 2 Agostino Sarubbo 2013-05-19 10:14:25 UTC]

amd64 stable

[Comment 3 Jeroen Roovers (RETIRED) 2013-05-19 13:22:45 UTC]

(In reply to comment #2)
> amd64 stable

The other half, too, please.

[Comment 4 Jeroen Roovers (RETIRED) 2013-05-19 13:23:05 UTC]

Stable for HPPA.

[Comment 5 Agostino Sarubbo 2013-05-19 13:30:56 UTC]

amd64 stable

[Comment 6 Agostino Sarubbo 2013-05-19 15:08:14 UTC]

x86 stable

[Comment 7 Agostino Sarubbo 2013-05-20 12:52:33 UTC]

ppc stable

[Comment 8 Agostino Sarubbo 2013-05-25 07:55:15 UTC]

sparc stable

[Comment 9 Agostino Sarubbo 2013-05-25 14:29:47 UTC]

alpha stable

[Comment 10 Agostino Sarubbo 2013-05-25 20:28:12 UTC]

ia64 stable

[Comment 11 Agostino Sarubbo 2013-05-25 20:48:36 UTC]

ppc64 stable

[Comment 12 Jeroen Roovers (RETIRED) 2013-05-28 14:02:51 UTC]

SPARC still needs to stabilise 1.6.15.

[Comment 13 Agostino Sarubbo 2013-06-09 12:16:26 UTC]

sparc stable

[Comment 14 GLSAMaker/CVETool Bot 2013-08-27 22:24:12 UTC]

CVE-2013-3562 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3562):
  Multiple integer signedness errors in the tvb_unmasked function in
  epan/dissectors/packet-websocket.c in the Websocket dissector in Wireshark
  1.8.x before 1.8.7 allow remote attackers to cause a denial of service
  (application crash) via a malformed packet.

CVE-2013-3561 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3561):
  Multiple integer overflows in Wireshark 1.8.x before 1.8.7 allow remote
  attackers to cause a denial of service (loop or application crash) via a
  malformed packet, related to a crash of the Websocket dissector, an infinite
  loop in the MySQL dissector, and a large loop in the ETCH dissector.

CVE-2013-3560 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3560):
  The dissect_dsmcc_un_download function in
  epan/dissectors/packet-mpeg-dsmcc.c in the MPEG DSM-CC dissector in
  Wireshark 1.8.x before 1.8.7 uses an incorrect format string, which allows
  remote attackers to cause a denial of service (application crash) via a
  malformed packet.

CVE-2013-3559 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3559):
  epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark
  1.8.x before 1.8.7 uses incorrect integer data types, which allows remote
  attackers to cause a denial of service (integer overflow, and heap memory
  corruption or NULL pointer dereference, and application crash) via a
  malformed packet.

CVE-2013-3558 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3558):
  The dissect_ccp_bsdcomp_opt function in epan/dissectors/packet-ppp.c in the
  PPP CCP dissector in Wireshark 1.8.x before 1.8.7 does not terminate a
  bit-field list, which allows remote attackers to cause a denial of service
  (application crash) via a malformed packet.

CVE-2013-3557 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3557):
  The dissect_ber_choice function in epan/dissectors/packet-ber.c in the ASN.1
  BER dissector in Wireshark 1.6.x before 1.6.15 and 1.8.x before 1.8.7 does
  not properly initialize a certain variable, which allows remote attackers to
  cause a denial of service (application crash) via a malformed packet.

CVE-2013-3556 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3556):
  The fragment_add_seq_common function in epan/reassemble.c in the ASN.1 BER
  dissector in Wireshark before r48943 has an incorrect pointer dereference
  during a comparison, which allows remote attackers to cause a denial of
  service (application crash) via a malformed packet.

CVE-2013-3555 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-3555):
  epan/dissectors/packet-gtpv2.c in the GTPv2 dissector in Wireshark 1.8.x
  before 1.8.7 calls incorrect functions in certain contexts related to
  ciphers, which allows remote attackers to cause a denial of service
  (application crash) via a malformed packet.

[Comment 15 Sergey Popov (RETIRED) 2013-08-28 06:00:46 UTC]

Adding to existing GLSA draft

[Comment 16 GLSAMaker/CVETool Bot 2013-08-28 11:43:53 UTC]

This issue was resolved and addressed in
 GLSA 201308-05 at http://security.gentoo.org/glsa/glsa-201308-05.xml
by GLSA coordinator Sergey Popov (pinkbyte).