Bug 604299 (CVE-2010-2285)

Summary:	CVE-2010-2285 wireshark: SMB PIPE dissector NULL pointer dereference
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jlayton, rvokal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-07-02 14:29:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2010-06-15 19:47:14 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2285 to
the following vulnerability:

Name: CVE-2010-2285
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2285
Assigned: 20100614
Reference: MLIST:[oss-security] 20100610 CVE request for new wireshark vulnerabilities
Reference: URL: http://www.openwall.com/lists/oss-security/2010/06/11/1
Reference: CONFIRM: http://www.wireshark.org/security/wnpa-sec-2010-05.html
Reference: CONFIRM: http://www.wireshark.org/security/wnpa-sec-2010-06.html
Reference: MANDRIVA:MDVSA-2010:113
Reference: URL: http://www.mandriva.com/security/advisories?name=MDVSA-2010:113
Reference: SECUNIA:40112
Reference: URL: http://secunia.com/advisories/40112
Reference: VUPEN:ADV-2010-1418
Reference: URL: http://www.vupen.com/english/advisories/2010/1418

The SMB PIPE dissector in Wireshark 0.8.20 through 1.0.13 and 1.2.0
through 1.2.8 allows remote attackers to cause a denial of service
(NULL pointer dereference) via unknown vectors.

Upstream commits:

trunk: http://anonsvn.wireshark.org/viewvc?view=rev&revision=32848
trunk-1.2: http://anonsvn.wireshark.org/viewvc?view=rev&revision=33120
trunk-1.0: http://anonsvn.wireshark.org/viewvc?view=rev&revision=33143

Comment 1 Vincent Danen 2010-06-15 20:06:44 UTC

Created wireshark tracking bugs for this issue

Affects: fedora-all [bug 549580]

Comment 3 Tomas Hoger 2010-07-02 14:29:56 UTC

This is a *printf("%s", NULL) flaw.  This leads to crash on some platforms, but this problem does not affect glibc printf functions implementation.

Statement:

Not vulnerable. This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 3, 4, or 5.