All about DOCSIS technology,CMTS Headends, Cable Television, Information technology, High Definition TV, IPTV, Fiber to the home. Cable Modem Drivers and Troubleshooting.

CERT-In Advisory CIAD-2007-35
Original issue date: June 29, 2007

Severity Rating: Medium
System Affected: Wireshark (Ethereal) versions 0.10.14 through 0.99.5

Overview

Multiple vulnerabilities have been reported in Wireshark (Ethereal) while reading malformed packet off the network which could be exploited by remote attackers to cause denial of service attack on the affected system.

Description

Wireshark (Ethereal) is a program for monitoring network traffic. Each protocol supported by it is handled through a bit of code known as a dissector.

1. Wireshark (Ethereal) denial of service vulnerability (CVE-2007-3389)
A vulnerability has been reported in Wireshark which could be exploited by remote attacker while processing malformed HTTP chunked responses to cause denial of service or crash the affected system.

2. Wireshark (Ethereal) SIGTRAP error (CVE-2007-3390)
A vulnerability exist in Wireshark which could be exploited by remote attacker to cause a denial of service (crash) via crafted iSeries capture files that trigger a SIGTRAP.

3. Wireshark (Ethereal) infinite loop error (CVE-2007-3391)
A vulnerability has been reported in Wireshark (Ethereal) which could be exploited by remote attacker to cause denial of service via a malformed DCP ETSI packet that triggers an infinite loop.

4. Wireshark (Ethereal) infinite loop error (CVE-2007-3392)
A vulnerability has been reported in Wireshark which could be exploited by remote attacker to cause a denial of service attack via malformed SSL or MMS packets that trigger an infinite loop.

5. Off-by-One error in DHCP/BOOTP Dissector (CVE-2007-3393 )
A vulnerability has been reported in Wireshark due to Off-by-one error in the DHCP/BOOTP dissector which could be exploited by remote attackers to cause a denial of service attack via crafted DHCP-over-DOCSIS packets.

Solution

Update to version 0.99.6.
http://www.wireshark.org/docs/relnotes/wireshark-0.99.6.html

References

WireShark
http://www.wireshark.org/docs/relnotes/wireshark-0.99.6.html http://www.wireshark.org/security/wnpa-sec-2007-02.html

FrSirt
http://www.frsirt.com/english/advisories/2007/2353

Secunia
http://secunia.com/advisories/25833/

Securityfocus
http://www.securityfocus.com/bid/24662