Red Hat Bugzilla – Bug 1199167
CVE-2015-2191 wireshark: The TNEF dissector could go into an infinite loop on 32-bit architectures (wnpa-sec-2015-10)
Last modified: 2015-11-24 07:25:39 EST
From https://www.wireshark.org/security/wnpa-sec-2015-10.html Name: TNEF dissector infinite loop Docid: wnpa-sec-2015-10 Date: March 4, 2015 Affected versions: 1.12.0 to 1.12.3, 1.10.0 to 1.10.10 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11023 Upstream 1.10.x patch: https://code.wireshark.org/review/#/c/7487/ Description: The TNEF dissector could go into an infinite loop. Discovered by Vlad Tsyrklevich. Impact: It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
Created wireshark tracking bugs for this issue: Affects: fedora-all [bug 1199173]
Patch ===== https://code.wireshark.org/review/gitweb?p=wireshark.git;a=patch;h=44a46a1fe55872237e206d6bb4aa046f2797d1ba POC === https://bugs.wireshark.org/bugzilla/attachment.cgi?id=13484
Hi Siddharth, I have troubles with reproducing the issue on RHEL-6. I seem to not meet the code path that is being patched, look: The vulnerable code is present: (gdb) l packet-tnef.c:624 619 proto_tree_add_item(attr_tree, hf_tnef_attribute_value, tvb, offset, length, ENC_NA); 620 break; 621 } 622 } 623 624 offset += length; 625 626 proto_tree_add_item(attr_tree, hf_tnef_attribute_checksum, tvb, offset, 2, ENC_LITTLE_ENDIAN); 627 offset += 2; 628 I set a breakpoint there: (gdb) b packet-tnef.c:624 Note: breakpoint 6 (disabled) also set at pc 0x7ffff55a03f8. Breakpoint 7 at 0x7ffff55a03f8: file packet-tnef.c, line 624. I read the file (renamed to CVE-2015-2191-tnef-dos.pcap) and nothing happens: (gdb) r -nr CVE-2015-2191-tnef-dos.pcap &>/dev/null Starting program: /usr/sbin/tshark -nr CVE-2015-2191-tnef-dos.pcap &>/dev/null [Thread debugging using libthread_db enabled] Program exited normally. I try to display the data to check if I really read the file: (gdb) r -nr CVE-2015-2191-tnef-dos.pcap Starting program: /usr/sbin/tshark -nr CVE-2015-2191-tnef-dos.pcap [Thread debugging using libthread_db enabled] 1 0.000000 192.168.1.4 -> 217.12.11.66 TCP 62 3326 > 587 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 SACK_PERM=1 2 0.018661 217.12.11.66 -> 192.168.1.4 TCP 60 587 > 3326 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 ... I do. Could you point me, please, what am I doing wrong?
Peter, maybe you could advise me on what I could be doing wrong. Thanks.
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2015:1460 https://rhn.redhat.com/errata/RHSA-2015-1460.html
Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:2393 https://rhn.redhat.com/errata/RHSA-2015-2393.html