Bug 513033 - (CVE-2009-2561) CVE-2009-2561 Wireshark: Dos (excessive CPU and memory use) via large amount of tree items in the sFlow dissector
CVE-2009-2561 Wireshark: Dos (excessive CPU and memory use) via large amount ...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
https://bugs.wireshark.org/bugzilla/s...
impact=low,public=20090720,reported=2...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-07-21 13:44 EDT by Jan Lieskovsky
Modified: 2010-06-25 05:48 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-06-25 05:48:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2009-07-21 13:44:39 EDT
A denial of service flaw was found in the Wireshark's sFlow dissector. 
A remote attacker could provide a specially-crafted sFlow packet
capture file, which once opened by an unsuspecting user would
utilize an excessive amount of CPU and memory.

References:
-----------
http://www.wireshark.org/security/wnpa-sec-2009-04.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3570

Reproducer:
-----------
https://bugs.wireshark.org/bugzilla/attachment.cgi?id=3177

Upstream patch:
---------------
http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-sflow.c?r1=28897&r2=28896&pathrev=28897&view=patch
Comment 1 Jan Lieskovsky 2009-07-21 13:45:55 EDT
This issue does NOT affect the versions of the wireshark package,
as shipped with Red Hat Enterprise Linux 3, 4, and 5.

This issue does NOT affect the version of the wireshark package,
as shipped with Fedora release of 10.

This issue affects the versions of the wireshark package,
as shipped with Fedora releases of 11 and Rawhide.
Comment 2 Jan Lieskovsky 2009-07-21 15:48:03 EDT
MITRE's CVE-2009-2561 entry:

Unspecified vulnerability in the sFlow dissector in Wireshark 1.2.0
allows remote attackers to cause a denial of service (CPU and memory
consumption) via unspecified vectors.

References:
----------
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2561
http://www.wireshark.org/security/wnpa-sec-2009-04.html
http://www.securityfocus.com/bid/35748
http://secunia.com/advisories/35884
http://www.vupen.com/english/advisories/2009/1970
Comment 3 Jan Lieskovsky 2009-08-12 06:37:34 EDT
Official statement from Red Hat Security Response Team regarding this issue:
----------------------------------------------------------------------------

Not vulnerable. This issue did not affect the versions of the Wireshark
package, as shipped with Red Hat Enterprise Linux 3, 4, or 5.
Comment 4 Fedora Update System 2009-11-04 07:02:20 EST
wireshark-1.2.2-1.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2009-12-04 18:38:50 EST
wireshark-1.2.1-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.