Bug 513033 (CVE-2009-2561)

Summary: CVE-2009-2561 Wireshark: Dos (excessive CPU and memory use) via large amount of tree items in the sFlow dissector
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rvokal
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3570
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-06-25 09:48:30 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2009-07-21 17:44:39 UTC
A denial of service flaw was found in the Wireshark's sFlow dissector. 
A remote attacker could provide a specially-crafted sFlow packet
capture file, which once opened by an unsuspecting user would
utilize an excessive amount of CPU and memory.

References:
-----------
http://www.wireshark.org/security/wnpa-sec-2009-04.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3570

Reproducer:
-----------
https://bugs.wireshark.org/bugzilla/attachment.cgi?id=3177

Upstream patch:
---------------
http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-sflow.c?r1=28897&r2=28896&pathrev=28897&view=patch

Comment 1 Jan Lieskovsky 2009-07-21 17:45:55 UTC
This issue does NOT affect the versions of the wireshark package,
as shipped with Red Hat Enterprise Linux 3, 4, and 5.

This issue does NOT affect the version of the wireshark package,
as shipped with Fedora release of 10.

This issue affects the versions of the wireshark package,
as shipped with Fedora releases of 11 and Rawhide.

Comment 2 Jan Lieskovsky 2009-07-21 19:48:03 UTC
MITRE's CVE-2009-2561 entry:

Unspecified vulnerability in the sFlow dissector in Wireshark 1.2.0
allows remote attackers to cause a denial of service (CPU and memory
consumption) via unspecified vectors.

References:
----------
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2561
http://www.wireshark.org/security/wnpa-sec-2009-04.html
http://www.securityfocus.com/bid/35748
http://secunia.com/advisories/35884
http://www.vupen.com/english/advisories/2009/1970

Comment 3 Jan Lieskovsky 2009-08-12 10:37:34 UTC
Official statement from Red Hat Security Response Team regarding this issue:
----------------------------------------------------------------------------

Not vulnerable. This issue did not affect the versions of the Wireshark
package, as shipped with Red Hat Enterprise Linux 3, 4, or 5.

Comment 4 Fedora Update System 2009-11-04 12:02:20 UTC
wireshark-1.2.2-1.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2009-12-04 23:38:50 UTC
wireshark-1.2.1-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.