Bug 1581787 (CVE-2018-11362)

Summary: CVE-2018-11362 wireshark: Out-of-bounds read in packet-ldss.c
Product: [Other] Security Response Reporter: Laura Pardo <lpardo>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: denis, huzaifas, lemenkov, mruprich, msehnout, phatina, rvokal
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: wireshark 2.6.1, wireshark 2.4.7, wireshark 2.2.15 Doc Type: If docs needed, set a value
Doc Text:
A heap-based buffer overflow was found in the wireshark module responsible for analyzing the LDSS protocol. An attacker could create a malicious LDSS message to cause a remote denial of service, crashing the application.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-03-31 22:32:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1581754, 1581791, 1588208    
Bug Blocks: 1581792    

Description Laura Pardo 2018-05-23 15:45:33 UTC
A flaw was found in Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. This was addressed in epan/dissectors/packet-ldss.c by avoiding a buffer over-read upon encountering a missing '\0' character.


Upstream patch:

Comment 1 Laura Pardo 2018-05-23 15:49:28 UTC
Created wireshark tracking bugs for this issue:

Affects: fedora-all [bug 1581754]

Comment 9 errata-xmlrpc 2020-03-31 19:15:51 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1047 https://access.redhat.com/errata/RHSA-2020:1047

Comment 10 Product Security DevOps Team 2020-03-31 22:32:27 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):