Red Hat Bugzilla – Bug 656456
CVE-2010-4300 Wireshark: Heap-based buffer overflow in LDSS dissector
Last modified: 2018-02-12 16:37:31 EST
A heap-based buffer overflow flaw was found in the way the Local Download Sharing Service (LDSS) dissector of Wireshark network traffic analyzer processed certain captures. A remote attacker could use this flaw to cause a tshark executable crash or, potentially, arbitrary code execution with the privileges of the user running tshark, if the local user opened a specially-crafted captures file. References: [1] https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5318 [2] http://www.wireshark.org/security/wnpa-sec-2010-14.html [3] http://www.openwall.com/lists/oss-security/2010/11/22/17 Upstream changeset: [4] http://anonsvn.wireshark.org/viewvc?view=rev&revision=34581 Public PoC: [5] https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5318#c0 Credit: Upstream acknowledges Nephi Johnson of BreakingPoint as the original reporter. Issue impact mitigation factor (from [1]): ------------------------------------------ One of the restrictions on the this is that the amount the buffer can be overflowed by is limited to the amount of data that can be transported in one TCP packet, as any following TCP packets are treated as file data and won't be reassembled as part of the first packet.
This issue did NOT affect the versions of the wireshark package, as shipped with Red Hat Enterprise Linux 4 and 5, as those versions do not include support for Local Download Sharing Service (LDSS) protocol yet. This issue affects the version of the wireshark package, as shipped with Red Hat Enterprise Linux 6. -- This issue affects the version of the wireshark package, as shipped with Fedora release of 12. This issue does NOT affect the versions of the wireshark package, as shipped with Fedora release of 13 and 14 (relevant packages were already updated, though they may be currently present in -testing repository yet).
Created wireshark tracking bugs for this issue Affects: fedora-12 [bug 656463]
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2010:0924 https://rhn.redhat.com/errata/RHSA-2010-0924.html
Statement: This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 4 and 5 as they did not include support for the Local Download Sharing Service (LDSS) protocol. This issue was addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2010-0924.html.