Bug 1180197 (CVE-2015-0564)

Summary:	CVE-2015-0564 wireshark: TLS/SSL decryption crash (wnpa-sec-2015-05)
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	huzaifas, jrusnack, lemenkov, phatina, rvokal, sisharma
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Wireshark 1.12.3, Wireshark 1.10.12	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-11-20 04:49:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1180198, 1208005, 1245763
Bug Blocks:	1180203, 1210268

Description Martin Prpič 2015-01-08 15:33:22 UTC

A buffer underflow flaw was found in the way Wireshark decypted TLS/SSL sessions. It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

This is reported to affect Wireshark versions 1.12.0 to 1.12.2, and 1.10.0 to 1.10.11. It is fixed in versions 1.12.3 and 1.10.12.

External References:

https://www.wireshark.org/security/wnpa-sec-2015-05.html

Comment 1 Martin Prpič 2015-01-08 15:34:00 UTC

Created wireshark tracking bugs for this issue:

Affects: fedora-all [bug 1180198]

Comment 2 Siddharth Sharma 2015-01-15 14:44:37 UTC

upstream fix
============

https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commitdiff;h=d3581aecda62d2a51ea7088fd46975415b03ec57;hp=ac52f0e6bf020fd9b12f603bdb6e90a469bceed8

Comment 4 Siddharth Sharma 2015-01-19 05:11:02 UTC

Analysis
========

In the wireshark code for decypted TLS/SSL sessions


  /* Now strip off the padding*/
    if(decoder->cipher_suite->block!=1) {
       pad=out_str->data[inl-1];
        worklen-=(pad+1);
        ssl_debug_printf("ssl_decrypt_record found padding %d final len %d\n",
            pad, worklen);
    }

at line  pad=out_str->data[inl-1]; 

if value of "inl" is less than 0 would cause wireshark to crash

Comment 6 errata-xmlrpc 2015-07-22 07:24:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:1460 https://rhn.redhat.com/errata/RHSA-2015-1460.html

Comment 10 errata-xmlrpc 2015-11-19 12:36:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2393 https://rhn.redhat.com/errata/RHSA-2015-2393.html

Comment 11 Huzaifa S. Sidhpurwala 2015-11-20 04:49:24 UTC

Statement:

This issue affects the verison of wireshark as shipped with Red Hat Enterprsie Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates.