ArchLinux: 201810-9: wireshark-cli: multiple issues
Summary
- CVE-2018-12086 (arbitrary code execution)
A flaw has been discovered in wireshark >= 2.6.0 and < 2.6.4 in the
OpcUa dissector where a specially crafted structured request could lead
to stack overflow. This could be used by an attacker to crash wireshark
or execute arbitrary code on the affected host by injecting a malformed
packet onto the wire or by convincing someone to read a malformed
packet trace file.
- CVE-2018-18225 (denial of service)
A flaw has been discovered in wireshark >= 2.6.0 and < 2.6.4 in the
CoAP dissector where an invalid frame could lead to NULL-pointer
dereference. This could be used by an attacker to crash wireshark by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.
- CVE-2018-18226 (denial of service)
A flaw has been discovered in wireshark >= 2.6.0 and < 2.6.4 in the
Steam IHS Discovery dissector where dynamically allocated memory was
not properly freed on exception. This could be used by an attacker to
crash wireshark by injecting a malformed packet onto the wire or by
convincing someone to read a malformed packet trace file.
- CVE-2018-18227 (denial of service)
A flaw has been discovered in wireshark >= 2.6.0 and < 2.6.4 in the
MS-WSP dissector where an invalid type could lead to an assertion
failure. This could be used by an attacker to crash wireshark by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.
Resolution
Upgrade to 2.6.4-1.
# pacman -Syu "wireshark-cli>=2.6.4-1"
The problems have been fixed upstream in version 2.6.4.
References
https://www.wireshark.org/docs/relnotes/wireshark-2.6.4.html https://www.wireshark.org/security/wnpa-sec-2018-50 https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-12086.pdf ;a=commitdiff;h=fc956747a139269a6fb4f67c639e12b3f4e9ccd9 https://www.wireshark.org/security/wnpa-sec-2018-49 https://gitlab.com/wireshark/wireshark/-/issues/15172 ;a=commitdiff;h=b2bbd9fdf209911d94b23cc33f4daccbceb7fa8a https://www.wireshark.org/security/wnpa-sec-2018-48 https://gitlab.com/wireshark/wireshark/-/issues/15171 ;a=commitdiff;h=6e920ddc3cad2886ef07ca1a8e50e2a5c50986f7 https://www.wireshark.org/security/wnpa-sec-2018-47 https://gitlab.com/wireshark/wireshark/-/issues/15119 ;a=commitdiff;h=536fb9403a5f6bcc060aaa2a1f35d8d0225bb1fd https://security.archlinux.org/CVE-2018-12086 https://security.archlinux.org/CVE-2018-18225 https://security.archlinux.org/CVE-2018-18226 https://security.archlinux.org/CVE-2018-18227
Workaround
None.