Bug 656456 (CVE-2010-4300)

Summary:	CVE-2010-4300 Wireshark: Heap-based buffer overflow in LDSS dissector
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jlayton, jsafrane, ksrot, mjc, rvokal, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-12-22 15:34:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	656463, 657534, 657535
Bug Blocks:

Description Jan Lieskovsky 2010-11-23 19:16:36 UTC

A heap-based buffer overflow flaw was found in the way
the Local Download Sharing Service (LDSS) dissector of Wireshark
network traffic analyzer processed certain captures. A remote
attacker could use this flaw to cause a tshark executable
crash or, potentially, arbitrary code execution with the
privileges of the user running tshark, if the local user
opened a specially-crafted captures file.

References:
[1] https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5318
[2] http://www.wireshark.org/security/wnpa-sec-2010-14.html
[3] http://www.openwall.com/lists/oss-security/2010/11/22/17

Upstream changeset:
[4] http://anonsvn.wireshark.org/viewvc?view=rev&revision=34581

Public PoC:
[5] https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5318#c0

Credit:
Upstream acknowledges Nephi Johnson of BreakingPoint as the original
reporter.

Issue impact mitigation factor (from [1]):
------------------------------------------
One of the restrictions on the this is that the amount the buffer can be
overflowed by is limited to the amount of data that can be transported in 
one TCP packet, as any following TCP packets are treated as file data and 
won't be reassembled as part of the first packet.

Comment 1 Jan Lieskovsky 2010-11-23 19:22:03 UTC

This issue did NOT affect the versions of the wireshark package,
as shipped with Red Hat Enterprise Linux 4 and 5, as those versions
do not include support for Local Download Sharing Service (LDSS)
protocol yet.

This issue affects the version of the wireshark package, as shipped
with Red Hat Enterprise Linux 6.

--

This issue affects the version of the wireshark package, as shipped
with Fedora release of 12.

This issue does NOT affect the versions of the wireshark package,
as shipped with Fedora release of 13 and 14 (relevant packages
were already updated, though they may be currently present in
-testing repository yet).

Comment 3 Jan Lieskovsky 2010-11-23 19:40:02 UTC

Created wireshark tracking bugs for this issue

Affects: fedora-12 [bug 656463]

Comment 6 errata-xmlrpc 2010-11-30 18:32:43 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2010:0924 https://rhn.redhat.com/errata/RHSA-2010-0924.html

Comment 7 Vincent Danen 2010-11-30 18:54:30 UTC

Statement:

This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 4 and 5 as they did not include support for the Local Download Sharing Service (LDSS) protocol.

This issue was addressed in Red Hat Enterprise Linux 6 via
https://rhn.redhat.com/errata/RHSA-2010-0924.html.