Multiple vulnerabilities were discovered in the dissectors for DVB-CI, GSM A Common and ASN.1 PER and in the Netmon file parser.

Updated wireshark package fixes security vulnerabilities :

The Bluetooth SDP dissector could go into a large loop (CVE-2013-4927).

The DIS dissector could go into a large loop (CVE-2013-4929).

The DVB-CI dissector could crash (CVE-2013-4930).

The GSM RR dissector (and possibly others) could go into a large loop (CVE-2013-4931).

The GSM A Common dissector could crash (CVE-2013-4932).

The Netmon file parser could crash (CVE-2013-4933, CVE-2013-4934).

The ASN.1 PER dissector could crash (CVE-2013-4935).

This wireshark version update from 1.8.8 to 1.8.9 includes several security and general bug fixes. (bnc#831718)

http://www.wireshark.org/docs/relnotes/wireshark-1.8.9.html

  - The Bluetooth SDP dissector could go into a large loop     CVE-2013-4927 wnpa-sec-2013-45

  - The DIS dissector could go into a large loop     CVE-2013-4929 wnpa-sec-2013-47

  - The DVB-CI dissector could crash CVE-2013-4930     wnpa-sec-2013-48

  - The GSM RR dissector (and possibly others) could go into     a large loop CVE-2013-4931 wnpa-sec-2013-49

  - The GSM A Common dissector could crash CVE-2013-4932     wnpa-sec-2013-50

  - The Netmon file parser could crash CVE-2013-4933 /     CVE-2013-4934 wnpa-sec-2013-51

  - The ASN.1 PER dissector could crash CVE-2013-4935     wnpa-sec-2013-52 The release also fixes various     non-security issues. Please see the package changelog     for details.

The installed version of Wireshark 1.10 is earlier than 1.10.1.  It is, therefore, affected by denial of service vulnerabilities in the following dissectors :

  - ASN.1 PER (Bug #8722)
  - Bluetooth OBEX (Bug #8875)
  - Bluetooth SDP (Bug #8831)
  - DCOM ISystemActivator (Bug #8828)
  - DCP ETSI (Bug #8717)
  - DIS (Bug #8911)
  - DVB-CI (Bug #8916)
  - GSM A Common (Bug #8940)
  - GSM RR (Bug #8923)
  - Netmon file parser (Bug #8742)
  - P1 (Bug #8826)
  - PROFINET Real-Time (Bug #8904)
  - Radiotap (Bug #8830)

ID	名稱	產品	系列	已發布	已更新	嚴重性
69228	Debian DSA-2734-1 : wireshark - several vulnerabilities	Nessus	Debian Local Security Checks	2013/8/7	2021/1/11	medium
69155	Mandriva Linux Security Advisory : wireshark (MDVSA-2013:204)	Nessus	Mandriva Local Security Checks	2013/7/31	2021/1/6	high
69894	SuSE 11.2 / 11.3 Security Update : wireshark (SAT Patch Numbers 8318 / 8319)	Nessus	SuSE Local Security Checks	2013/9/14	2021/1/19	high
69105	Wireshark 1.10.x < 1.10.1 Multiple Vulnerabilities	Nessus	Windows	2013/7/29	2026/3/30	high

偵測

搜尋 Plugin

medium

high

high

high