Bug 1199167 (CVE-2015-2191)
| Summary: | CVE-2015-2191 wireshark: The TNEF dissector could go into an infinite loop on 32-bit architectures (wnpa-sec-2015-10) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Vasyl Kaigorodov <vkaigoro> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | ebenes, huzaifas, jrusnack, lemenkov, phatina, rvokal, sisharma |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Wireshark 1.12.4,Wireshark 1.10.13 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-11-20 04:50:31 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1199173, 1208005, 1245883, 1245885 | ||
| Bug Blocks: | 1199171, 1210268 | ||
|
Description
Vasyl Kaigorodov
2015-03-05 14:41:16 UTC
Created wireshark tracking bugs for this issue: Affects: fedora-all [bug 1199173] Patch ===== https://code.wireshark.org/review/gitweb?p=wireshark.git;a=patch;h=44a46a1fe55872237e206d6bb4aa046f2797d1ba POC === https://bugs.wireshark.org/bugzilla/attachment.cgi?id=13484 Hi Siddharth, I have troubles with reproducing the issue on RHEL-6. I seem to not meet the code path that is being patched, look: The vulnerable code is present: (gdb) l packet-tnef.c:624 619 proto_tree_add_item(attr_tree, hf_tnef_attribute_value, tvb, offset, length, ENC_NA); 620 break; 621 } 622 } 623 624 offset += length; 625 626 proto_tree_add_item(attr_tree, hf_tnef_attribute_checksum, tvb, offset, 2, ENC_LITTLE_ENDIAN); 627 offset += 2; 628 I set a breakpoint there: (gdb) b packet-tnef.c:624 Note: breakpoint 6 (disabled) also set at pc 0x7ffff55a03f8. Breakpoint 7 at 0x7ffff55a03f8: file packet-tnef.c, line 624. I read the file (renamed to CVE-2015-2191-tnef-dos.pcap) and nothing happens: (gdb) r -nr CVE-2015-2191-tnef-dos.pcap &>/dev/null Starting program: /usr/sbin/tshark -nr CVE-2015-2191-tnef-dos.pcap &>/dev/null [Thread debugging using libthread_db enabled] Program exited normally. I try to display the data to check if I really read the file: (gdb) r -nr CVE-2015-2191-tnef-dos.pcap Starting program: /usr/sbin/tshark -nr CVE-2015-2191-tnef-dos.pcap [Thread debugging using libthread_db enabled] 1 0.000000 192.168.1.4 -> 217.12.11.66 TCP 62 3326 > 587 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 SACK_PERM=1 2 0.018661 217.12.11.66 -> 192.168.1.4 TCP 60 587 > 3326 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 ... I do. Could you point me, please, what am I doing wrong? Peter, maybe you could advise me on what I could be doing wrong. Thanks. This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2015:1460 https://rhn.redhat.com/errata/RHSA-2015-1460.html Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/. This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:2393 https://rhn.redhat.com/errata/RHSA-2015-2393.html |