Bug 604299 (CVE-2010-2285)

Summary: CVE-2010-2285 wireshark: SMB PIPE dissector NULL pointer dereference
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: jlayton, rvokal
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: public=20100609,reported=20100609,source=vendor-sec,rhel-3/wireshark=notaffected/impact=none/cvss2=2.9/AV:A/AC:M/Au:N/C:N/I:N/A:P,rhel-4/wireshark=notaffected/impact=none/cvss2=2.9/AV:A/AC:M/Au:N/C:N/I:N/A:P,rhel-5/wireshark=notaffected/impact=none/cvss2=2.9/AV:A/AC:M/Au:N/C:N/I:N/A:P,rhel-6/wireshark=notaffected/impact=none/cvss2=2.9/AV:A/AC:M/Au:N/C:N/I:N/A:P,fedora-all/wireshark=notaffected/impact=none/cvss2=2.9/AV:A/AC:M/Au:N/C:N/I:N/A:P,cwe=CWE-476[auto]
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-07-02 10:29:56 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Vincent Danen 2010-06-15 15:47:14 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2285 to
the following vulnerability:

Name: CVE-2010-2285
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2285
Assigned: 20100614
Reference: MLIST:[oss-security] 20100610 CVE request for new wireshark vulnerabilities
Reference: URL: http://www.openwall.com/lists/oss-security/2010/06/11/1
Reference: CONFIRM: http://www.wireshark.org/security/wnpa-sec-2010-05.html
Reference: CONFIRM: http://www.wireshark.org/security/wnpa-sec-2010-06.html
Reference: MANDRIVA:MDVSA-2010:113
Reference: URL: http://www.mandriva.com/security/advisories?name=MDVSA-2010:113
Reference: SECUNIA:40112
Reference: URL: http://secunia.com/advisories/40112
Reference: VUPEN:ADV-2010-1418
Reference: URL: http://www.vupen.com/english/advisories/2010/1418

The SMB PIPE dissector in Wireshark 0.8.20 through 1.0.13 and 1.2.0
through 1.2.8 allows remote attackers to cause a denial of service
(NULL pointer dereference) via unknown vectors.

Upstream commits:

trunk: http://anonsvn.wireshark.org/viewvc?view=rev&revision=32848
trunk-1.2: http://anonsvn.wireshark.org/viewvc?view=rev&revision=33120
trunk-1.0: http://anonsvn.wireshark.org/viewvc?view=rev&revision=33143
Comment 1 Vincent Danen 2010-06-15 16:06:44 EDT
Created wireshark tracking bugs for this issue

Affects: fedora-all [bug 549580]
Comment 3 Tomas Hoger 2010-07-02 10:29:56 EDT
This is a *printf("%s", NULL) flaw.  This leads to crash on some platforms, but this problem does not affect glibc printf functions implementation.

Statement:

Not vulnerable. This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 3, 4, or 5.