Common Vulnerabilities and Exposures assigned an identifier CVE-2009-1210 to the following vulnerability: Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark 1.0.6 and earlier allows remote attackers to execute arbitrary code via a PN-DCP packet with format string specifiers in the station name. NOTE: some of these details are obtained from third party information. References: http://www.milw0rm.com/exploits/8308 http://www.securityfocus.com/bid/34291 http://secunia.com/advisories/34542 http://xforce.iss.net/xforce/xfdb/49512
Upstream bug report: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3382 Upstream SVN commit, fixing multiple format string flaws across wireshark sources: trunk: http://anonsvn.wireshark.org/viewvc?view=rev&revision=26652 trunk-1.0: http://anonsvn.wireshark.org/viewvc?view=rev&revision=27926 Fix should be included in upstream 1.0.7. Format string demonstrated by the published profinet PoC is caught by fortify source on Red Hat Enterprise Linux 5 and later, reducing impact of the flaw to non-exploitable crash.
Created attachment 338058 [details] Reproducer Source: http://www.milw0rm.com/exploits/8308
wireshark-1.0.7-1.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
wireshark-1.0.8-1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
Work-around: Disable affected Profinet dissectors. This can be done via GUI - Analyze -> Enabled Protocols... and disable all Profinet dissectors (PN-*). Alternatively, you can list Profinet dissectors in local (~/.wireshark/disabled_protos) or global (/usr/share/wireshark/disabled_protos) disabled_protos configuration file, read by both GNOME Wireshark GUI and text-only tshark: pn_dcp pn_mrp pn_mrrt pn_ptcp pn_rt Refer to Wireshark documentation regarding further details about configuration file format.
This issue has been addressed in following products: Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 4 Via RHSA-2009:1100 https://rhn.redhat.com/errata/RHSA-2009-1100.html