Bug 656437 (CVE-2010-4301)

Summary:	CVE-2010-4301 Wireshark: Infinite loop in Zigbee ZCL dissector
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jlayton, jsafrane, rvokal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-21 09:32:29 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2010-11-23 18:12:37 UTC

A denial of service flaw was found in the way the Zigbee ZCL
dissector of Wireshark network traffic analyzer processed
certain captures. A remote attacker could use this flaw to
cause an infinite loop, if the local user opened 
a specially-crafted captures file in Wireshark.

References:
[1] https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5303
[2] http://www.wireshark.org/security/wnpa-sec-2010-14.html
[3] http://www.openwall.com/lists/oss-security/2010/11/22/17

Comment 1 Jan Lieskovsky 2010-11-23 18:17:30 UTC

This issue did NOT affect the versions of the wireshark package,
as shipped with Red Hat Enterprise Linux 4, 5, or 6, as those
versions do not provide support for the Zigbee Cluster Library
(ZCL) protocol yet.

--

This issue did NOT affect the versions of the wireshark package,
as shipped with Fedora release of 12 and 13, as those versions
do not provide support for the Zigbee Cluster Library (ZCL)
protocol yet.

This issue does NOT affect the version of the wireshark package,
as shipped with Fedora release of 14 (relevant packages are already
updated to v1.4.2).

Comment 2 Jan Lieskovsky 2010-11-23 18:20:23 UTC

Statement:

This issue did not affect the versions of wireshark shipped with
Red Hat Enterprise Linux 4, 5, and 6, as they did not include
support for the Zigbee Cluster Library (ZCL) protocol.