Red Hat Bugzilla – Bug 493973
CVE-2009-1210 wireshark: format string in PROFINET dissector
Last modified: 2012-06-20 10:42:16 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-1210 to the following vulnerability:
Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark
1.0.6 and earlier allows remote attackers to execute arbitrary code via a
PN-DCP packet with format string specifiers in the station name. NOTE: some of
these details are obtained from third party information.
Upstream bug report:
Upstream SVN commit, fixing multiple format string flaws across wireshark sources:
Fix should be included in upstream 1.0.7.
Format string demonstrated by the published profinet PoC is caught by fortify source on Red Hat Enterprise Linux 5 and later, reducing impact of the flaw to non-exploitable crash.
Created attachment 338058 [details]
wireshark-1.0.7-1.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
wireshark-1.0.8-1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
Disable affected Profinet dissectors. This can be done via GUI - Analyze -> Enabled Protocols... and disable all Profinet dissectors (PN-*).
Alternatively, you can list Profinet dissectors in local (~/.wireshark/disabled_protos) or global (/usr/share/wireshark/disabled_protos) disabled_protos configuration file, read by both GNOME Wireshark GUI and text-only tshark:
Refer to Wireshark documentation regarding further details about configuration file format.
This issue has been addressed in following products:
Red Hat Enterprise Linux 3
Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 4
Via RHSA-2009:1100 https://rhn.redhat.com/errata/RHSA-2009-1100.html