Wireshark up to 1.6.7 on SPARC/Itanium denial of service [CVE-2012-2394]

VulDB: Wireshark up to 1.6.7 on SPARC/Itanium denial of service [CVE-2012-2394]

General

scipID: 5442
Affected: Wireshark up to 1.6.7
Published: 05/22/2012 (Klaus Heckelmann)
Risk: problematic
Entry: 87% complete
Created: 05/25/2012
Updated: 09/03/2012

Summary

A vulnerability classified as problematic has been found in Wireshark up to 1.6.7 (SPARC/Itanium). Affected is an unknown function. The manipulation with an unknown input leads to a denial of service vulnerability. This is going to have an impact on availability.

The weakness was disclosed 05/22/2012 by Klaus Heckelmann as wnpa-sec-2012-10 as knowledge base article (Website). The advisory is shared for download at wireshark.org. The public release has been coordinated in cooperation with the vendor. This vulnerability is traded as CVE-2012-2394 since 04/19/2012. It is possible to launch the attack remotely. The exploitation doesn’t require any form of authentication. Technical details are unknown but a private exploit is available.

Upgrading to version 1.6.8 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability is also documented in the databases at OSVDB (82100) and Secunia (SA49226).