Bug 531260 (CVE-2009-3550)

Summary: CVE-2009-3550 Wireshark: NULL pointer dereference in the DCERPC over SMB packet disassembly
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: kreilly, mjc, rvokal, security-response-team, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcerpc-nt.c?view=log&pathrev=30208
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-06-25 09:47:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 537905, 549581, 549582, 549583, 549584, 561099, 833992    
Bug Blocks:    

Description Jan Lieskovsky 2009-10-27 14:08:41 UTC 
A NULL pointer dereference flaw was found in the Wireshark's DCERPC 
dissector. A remote attacker could provide a specially-crafted DCERPC
packet capture file, which once opened by an unsuspecting user would
lead to denial of service (Wireshark crash).

Upstream patch:
---------------
http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcerpc-nt.c?view=log&pathrev=30208
Comment 1 Jan Lieskovsky 2009-10-27 14:10:21 UTC 
This issue affects the versions of the wireshark package, as shipped
with Red Hat Enterprise Linux 3, 4, and 5.

This issue affects the versions of the wireshark package, as shipped
with Fedora releases of 10, 11, and as scheduled to appear in
Fedora release of 12.
Comment 2 Tomas Hoger 2009-10-28 08:24:52 UTC 
1.2.3: http://www.wireshark.org/security/wnpa-sec-2009-07.html
1.0.10: http://www.wireshark.org/security/wnpa-sec-2009-08.html
Comment 6 errata-xmlrpc 2010-04-20 15:31:34 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 3

Via RHSA-2010:0360 https://rhn.redhat.com/errata/RHSA-2010-0360.html