ID CVE-2017-11409
Summary In Wireshark 2.0.0 to 2.0.13, the GPRS LLC dissector could go into a large loop. This was addressed in epan/dissectors/packet-gprs-llc.c by using a different integer data type.
References
Vulnerable Configurations
  • Wireshark 2.0.0
    cpe:2.3:a:wireshark:wireshark:2.0.0
  • Wireshark 2.0.1
    cpe:2.3:a:wireshark:wireshark:2.0.1
  • Wireshark 2.0.2
    cpe:2.3:a:wireshark:wireshark:2.0.2
  • Wireshark 2.0.3
    cpe:2.3:a:wireshark:wireshark:2.0.3
  • Wireshark 2.0.4
    cpe:2.3:a:wireshark:wireshark:2.0.4
  • Wireshark 2.0.5
    cpe:2.3:a:wireshark:wireshark:2.0.5
  • Wireshark 2.0.6
    cpe:2.3:a:wireshark:wireshark:2.0.6
  • Wireshark 2.0.7
    cpe:2.3:a:wireshark:wireshark:2.0.7
  • Wireshark 2.0.8
    cpe:2.3:a:wireshark:wireshark:2.0.8
  • Wireshark 2.0.9
    cpe:2.3:a:wireshark:wireshark:2.0.9
  • Wireshark 2.0.10
    cpe:2.3:a:wireshark:wireshark:2.0.10
  • Wireshark 2.0.11
    cpe:2.3:a:wireshark:wireshark:2.0.11
  • Wireshark 2.0.12
    cpe:2.3:a:wireshark:wireshark:2.0.12
  • Wireshark 2.0.13
    cpe:2.3:a:wireshark:wireshark:2.0.13
CVSS
Base: 7.8
Impact:
Exploitability:
CWE CWE-399
CAPEC
nessus via4
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_WIRESHARK_2_2_8.NASL
    description The version of Wireshark installed on the remote macOS or Mac OS X host is 2.0.x prior to 2.0.14 or 2.2.x prior to 2.2.8. It is, therefore, affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists in the DAAP dissector, specifically in the dissect_daap_one_tag() function within file epan/dissectors/packet-daap.c. An unauthenticated, remote attacker can exploit this to exhaust stack resources through uncontrolled recursion. (CVE-2017-9617) - An infinite loop condition exists in the DOCSIS dissector, specifically in the dissect_docsis() function within file plugins/docsis/packet-docsis.c. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to consume available CPU resources, resulting in a denial of service condition. (CVE-2017-11406) - A memory allocation issue exists in the MQ dissector, specifically in the reassemble_mq() function within file epan/dissectors/packet-mq.c, due to improper validation of fragment lengths before attempting reassembly. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a denial of service condition. (CVE-2017-11407) - A flaw exists in the AMQP dissector, specifically in the get_amqp_1_0_value_formatter() function within file epan/dissectors/packet-amqp.c, when decoding lists. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a stack overflow, resulting in a denial of service condition. (CVE-2017-11408) - A large loop condition exists in the GPRS LLC dissector, specifically in the llc_gprs_dissect_xid() function within file epan/dissectors/packet-gprs-llc.c, when handling specially crafted packet or trace files. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. Note that this issue only applies to version 2.0.x. (CVE-2017-11409) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-01-16
    modified 2018-07-14
    plugin id 101897
    published 2017-07-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101897
    title Wireshark 2.0.x < 2.0.14 / 2.2.x < 2.2.8 Multiple DoS (macOS)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-1634.NASL
    description Several issues in wireshark, a tool that captures and analyzes packets off the wire, have been found by different people. These are basically issues with length checks or invalid memory access in different dissectors. This could result in infinite loops or crashes by malicious packets. For Debian 8 'Jessie', these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u16. We recommend that you upgrade your wireshark packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-01-17
    modified 2019-01-16
    plugin id 121193
    published 2019-01-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=121193
    title Debian DLA-1634-1 : wireshark security update
  • NASL family Windows
    NASL id WIRESHARK_2_2_8.NASL
    description The version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.14 or 2.2.x prior to 2.2.8. It is, therefore, affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists in the DAAP dissector, specifically in the dissect_daap_one_tag() function within file epan/dissectors/packet-daap.c. An unauthenticated, remote attacker can exploit this to exhaust stack resources through uncontrolled recursion. (CVE-2017-9617) - An infinite loop condition exists in the DOCSIS dissector, specifically in the dissect_docsis() function within file plugins/docsis/packet-docsis.c. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to consume available CPU resources, resulting in a denial of service condition. (CVE-2017-11406) - A memory allocation issue exists in the MQ dissector, specifically in the reassemble_mq() function within file epan/dissectors/packet-mq.c, due to improper validation of fragment lengths before attempting reassembly. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a denial of service condition. (CVE-2017-11407) - A flaw exists in the AMQP dissector, specifically in the get_amqp_1_0_value_formatter() function within file epan/dissectors/packet-amqp.c, when decoding lists. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a stack overflow, resulting in a denial of service condition. (CVE-2017-11408) - A large loop condition exists in the GPRS LLC dissector, specifically in the llc_gprs_dissect_xid() function within file epan/dissectors/packet-gprs-llc.c, when handling specially crafted packet or trace files. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. Note that this issue only applies to version 2.0.x. (CVE-2017-11409) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-01-16
    modified 2018-08-07
    plugin id 101898
    published 2017-07-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101898
    title Wireshark 2.0.x < 2.0.14 / 2.2.x < 2.2.8 Multiple DoS
refmap via4
bid 99914
confirm
mlist [debian-lts-announce] 20190115 [SECURITY] [DLA 1634-1] wireshark security update
sectrack 1038966
Last major update 18-07-2017 - 17:29
Published 18-07-2017 - 17:29
Last modified 16-01-2019 - 06:29
Back to Top