An integer overflow flaw, leading to heap-based buffer overflow was found in the Wireshark's Bluetooth L2CAP dissector. A remote attacker could provide a specially-crafted L2CAP packet capture file, which once opened by an unsuspecting user would lead to denial of service (Wireshark crash). References: ---------- http://www.wireshark.org/security/wnpa-sec-2009-04.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3572 Reproducer: ---------- https://bugs.wireshark.org/bugzilla/attachment.cgi?id=3179 Upstream patch: --------------- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-btl2cap.c?r1=28884&r2=28883&pathrev=28884&view=patch
This issue does NOT affect the versions of the wireshark package, as shipped with Red Hat Enterprise Linux 3, 4, and 5. This issue does NOT affect the version of the wireshark package, as shipped with Fedora release of 10. This issue affects the versions of the wireshark package, as shipped with Fedora releases of 11, and Rawhide.
MITRE's CVE-2009-2560 entry: Multiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause a denial of service (crash) via unspecified vectors in the (1) Bluetooth L2CAP, (2) RADIUS, or (3) MIOP dissectors. References: ----------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2560 http://www.wireshark.org/security/wnpa-sec-2009-04.html http://www.securityfocus.com/bid/35748 http://secunia.com/advisories/35884 http://www.vupen.com/english/advisories/2009/1970
*** This bug has been marked as a duplicate of bug 513008 ***