Bug 1199167 (CVE-2015-2191) - CVE-2015-2191 wireshark: The TNEF dissector could go into an infinite loop on 32-bit architectures (wnpa-sec-2015-10)
Summary: CVE-2015-2191 wireshark: The TNEF dissector could go into an infinite loop on...
Status: CLOSED ERRATA
Alias: CVE-2015-2191
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20150304,reported=2...
Keywords: Security
Depends On: 1199173 1208005 1245883 1245885
Blocks: 1199171 1210268
TreeView+ depends on / blocked
 
Reported: 2015-03-05 14:41 UTC by Vasyl Kaigorodov
Modified: 2019-06-08 20:28 UTC (History)
7 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2015-11-20 04:50:31 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1460 normal SHIPPED_LIVE Moderate: wireshark security, bug fix, and enhancement update 2015-07-21 14:14:59 UTC
Red Hat Product Errata RHSA-2015:2393 normal SHIPPED_LIVE Moderate: wireshark security, bug fix, and enhancement update 2015-11-19 11:03:11 UTC

Description Vasyl Kaigorodov 2015-03-05 14:41:16 UTC
From https://www.wireshark.org/security/wnpa-sec-2015-10.html

Name: TNEF dissector infinite loop
Docid: wnpa-sec-2015-10
Date: March 4, 2015
Affected versions: 1.12.0 to 1.12.3, 1.10.0 to 1.10.10

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11023
Upstream 1.10.x patch: https://code.wireshark.org/review/#/c/7487/

Description: The TNEF dissector could go into an infinite loop. Discovered by Vlad Tsyrklevich.
Impact: It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

Comment 1 Vasyl Kaigorodov 2015-03-05 14:50:05 UTC
Created wireshark tracking bugs for this issue:

Affects: fedora-all [bug 1199173]

Comment 4 Martin Žember 2015-04-23 23:31:37 UTC
Hi Siddharth,

I have troubles with reproducing the issue on RHEL-6.
I seem to not meet the code path that is being patched, look:

The vulnerable code is present:
(gdb) l packet-tnef.c:624
619			    proto_tree_add_item(attr_tree, hf_tnef_attribute_value, tvb, offset, length, ENC_NA);
620			    break;
621		    }
622	    }
623	
624	    offset += length;
625	
626	    proto_tree_add_item(attr_tree, hf_tnef_attribute_checksum, tvb, offset, 2, ENC_LITTLE_ENDIAN);
627	    offset += 2;
628	

I set a breakpoint there:
(gdb) b packet-tnef.c:624
Note: breakpoint 6 (disabled) also set at pc 0x7ffff55a03f8.
Breakpoint 7 at 0x7ffff55a03f8: file packet-tnef.c, line 624.

I read the file (renamed to CVE-2015-2191-tnef-dos.pcap) and nothing happens:
(gdb) r -nr CVE-2015-2191-tnef-dos.pcap &>/dev/null
Starting program: /usr/sbin/tshark -nr CVE-2015-2191-tnef-dos.pcap &>/dev/null
[Thread debugging using libthread_db enabled]

Program exited normally.

I try to display the data to check if I really read the file:
(gdb) r -nr CVE-2015-2191-tnef-dos.pcap
Starting program: /usr/sbin/tshark -nr CVE-2015-2191-tnef-dos.pcap
[Thread debugging using libthread_db enabled]
  1   0.000000  192.168.1.4 -> 217.12.11.66 TCP 62 3326 > 587 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 SACK_PERM=1
  2   0.018661 217.12.11.66 -> 192.168.1.4  TCP 60 587 > 3326 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460
...

I do.

Could you point me, please, what am I doing wrong?

Comment 5 Martin Žember 2015-04-27 15:06:53 UTC
Peter, maybe you could advise me on what I could be doing wrong.

Thanks.

Comment 7 errata-xmlrpc 2015-07-22 07:24:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:1460 https://rhn.redhat.com/errata/RHSA-2015-1460.html

Comment 12 Siddharth Sharma 2015-10-27 17:23:37 UTC
Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Comment 13 errata-xmlrpc 2015-11-19 12:36:59 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2393 https://rhn.redhat.com/errata/RHSA-2015-2393.html


Note You need to log in before you can comment on or make changes to this bug.