An insufficient user-provided input validation flaw was found in the Wireshark's MIOP dissector. A remote attacker could provide a specially-crafted MIOP packet capture file, which once opened by an unsuspecting user, would attempt to read past the bounds of allocated buffer, leading to application (Wireshark) abort. References: ---------- http://www.wireshark.org/security/wnpa-sec-2009-04.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3652 Reproducer: ----------- https://bugs.wireshark.org/bugzilla/attachment.cgi?id=3243 Upstream patch: --------------- http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-ziop.c?r1=29095&r2=29094&pathrev=29095&view=patch
This issue does NOT affect the versions of the wireshark package, as shipped with Red Hat Enterprise Linux 3, 4, and 5. This issue does NOT affect the version of the wireshark package, as shipped with Fedora release of 10. This issue affects the versions of the wireshark package, as shipped with Fedora releases of 11 and Rawhide.
MITRE's CVE-2009-2560 entry: Multiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause a denial of service (crash) via unspecified vectors in the (1) Bluetooth L2CAP, (2) RADIUS, or (3) MIOP dissectors. References: ----------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2560 http://www.wireshark.org/security/wnpa-sec-2009-04.html http://www.securityfocus.com/bid/35748 http://secunia.com/advisories/35884 http://www.vupen.com/english/advisories/2009/1970
*** This bug has been marked as a duplicate of bug 513008 ***