Wireshark up to 1.6.7 Packet Parser denial of service

VulDB: Wireshark up to 1.6.7 Packet Parser denial of service

General

scipID: 5444
Affected: Wireshark up to 1.6.7
Published: 05/22/2012 (Laurent Butti)
Risk: problematic
Entry: 89.5% complete
Created: 05/25/2012
Updated: 09/03/2012

Summary

A vulnerability, which was classified as problematic, has been found in Wireshark up to 1.6.7. Affected by this issue is an unknown function of the component Packet Parser. The manipulation with an unknown input leads to a denial of service vulnerability. Impacted is availability.

The weakness was shared 05/22/2012 by Laurent Butti as wnpa-sec-2012-08. The advisory is shared for download at wireshark.org. The vendor cooperated in the coordination of the public release. This vulnerability is handled as CVE-2012-2392 since 04/19/2012. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a private exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 59240 (Wireshark 1.6.x < 1.6.8 Multiple Denial of Service Vulnerabilities), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Windows and running in the context local.

Upgrading to version 1.6.8 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability is also documented in the databases at OSVDB (82098) and Secunia (SA49226).