A buffer underflow flaw was found in the way Wireshark decypted TLS/SSL sessions. It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. This is reported to affect Wireshark versions 1.12.0 to 1.12.2, and 1.10.0 to 1.10.11. It is fixed in versions 1.12.3 and 1.10.12. External References: https://www.wireshark.org/security/wnpa-sec-2015-05.html
Created wireshark tracking bugs for this issue: Affects: fedora-all [bug 1180198]
upstream fix ============ https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commitdiff;h=d3581aecda62d2a51ea7088fd46975415b03ec57;hp=ac52f0e6bf020fd9b12f603bdb6e90a469bceed8
Analysis ======== In the wireshark code for decypted TLS/SSL sessions /* Now strip off the padding*/ if(decoder->cipher_suite->block!=1) { pad=out_str->data[inl-1]; worklen-=(pad+1); ssl_debug_printf("ssl_decrypt_record found padding %d final len %d\n", pad, worklen); } at line pad=out_str->data[inl-1]; if value of "inl" is less than 0 would cause wireshark to crash
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2015:1460 https://rhn.redhat.com/errata/RHSA-2015-1460.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:2393 https://rhn.redhat.com/errata/RHSA-2015-2393.html
Statement: This issue affects the verison of wireshark as shipped with Red Hat Enterprsie Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates.