Name: Multiple problems in Ethereal versions 0.7.9 to 0.99.0

Docid: enpa-sa-00024

Date: November 10, 2006

Versions affected: 0.7.9 up to and including 0.99.0

Severity: High

Description:

Multiple vulnerabilities have been found in Ethereal versions 0.7.9 to 0.99.0, inclusive:

• The GSM BSSMAP dissector could crash.
  Versions affected: 0.10.11 to 0.99.0.
  CVE: CVE-2006-3627

  Ilja van Sprundel discovered the following vulnerabilities:

  • The ANSI MAP dissector was vulnerable to a format string overflow.
    Versions affected: 0.10.0 to 0.99.0.
    CVE: CVE-2006-3628

  • The Checkpoint FW-1 dissector was vulnerable to a format string overflow.
    Versions affected: 0.10.10 to 0.99.0.
    CVE: CVE-2006-3628

  • The MQ dissector was vulnerable to a format string overflow.
    Versions affected: 0.10.4 to 0.99.0.
    CVE: CVE-2006-3628

  • The XML dissector was vulnerable to a format string overflow.
    Versions affected: 0.10.13 to 0.99.0.
    CVE: CVE-2006-3628

  • The MOUNT dissector could attempt to allocate large amounts of memory.
    Versions affected: 0.9.4 to 0.99.0.
    CVE: CVE-2006-3629

  • The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors.
    Versions affected: 0.9.7 to 0.99.0.
    CVE: CVE-2006-3630

  • The NTP dissector was vulnerable to a format string overflow.
    Versions affected: 0.10.13 to 0.99.0.
    CVE: CVE-2006-3628

  • The SSH dissector was vulnerable to an infinite loop.
    Versions affected: 0.9.10 to 0.99.0.
    CVE: CVE-2006-3631

  • The NFS dissector may have been susceptible to a buffer overflow.
    Versions affected: 0.8.16 to 0.99.0.
    CVE: CVE-2006-3632

• The DHCP dissector (and possibly others) in the Windows version of Wireshark could trigger a bug in Glib and crash.
  Versions affected: 0.10.13 - 0.99.2.
  CVE: CVE-2006-4332

• If the SSCOP dissector has a port range configured and the SSCOP payload protocol is Q.2931, a malformed packet could make the Q.2931 dissector use up available memory. No port range is configured by default.
  Versions affected: 0.7.9 - 0.99.2.
  CVE: CVE-2006-4333

• The XOT dissector could attempt to allocate a large amount of memory and crash. (Bug 1133)
  Versions affected: 0.9.8 to 0.99.3.
  CVE-2006-4805

• The WBXML dissector could crash. (Bug 1134)
  Versions affected: 0.10.11 to 0.99.3.
  CVE-2006-5469

• The MIME Multipart dissector was susceptible to an off-by-one error. (Bug 1135)
  Versions affected: 0.10.1 to 0.99.3.
  CVE-2006-4574

Impact:

Resolution:

Upgrade to Wireshark 0.99.4 or higher.

Due to the severity and scope of the defects that have been discovered, no workaround is available.