Bug 656456 (CVE-2010-4300) - CVE-2010-4300 Wireshark: Heap-based buffer overflow in LDSS dissector
Summary: CVE-2010-4300 Wireshark: Heap-based buffer overflow in LDSS dissector
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-4300
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 656463 657534 657535
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-11-23 19:16 UTC by Jan Lieskovsky
Modified: 2021-02-24 16:59 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-12-22 15:34:44 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0924 0 normal SHIPPED_LIVE Moderate: wireshark security update 2010-11-30 18:32:34 UTC

Description Jan Lieskovsky 2010-11-23 19:16:36 UTC
A heap-based buffer overflow flaw was found in the way
the Local Download Sharing Service (LDSS) dissector of Wireshark
network traffic analyzer processed certain captures. A remote
attacker could use this flaw to cause a tshark executable
crash or, potentially, arbitrary code execution with the
privileges of the user running tshark, if the local user
opened a specially-crafted captures file.

References:
[1] https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5318
[2] http://www.wireshark.org/security/wnpa-sec-2010-14.html
[3] http://www.openwall.com/lists/oss-security/2010/11/22/17

Upstream changeset:
[4] http://anonsvn.wireshark.org/viewvc?view=rev&revision=34581

Public PoC:
[5] https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5318#c0

Credit:
Upstream acknowledges Nephi Johnson of BreakingPoint as the original
reporter.

Issue impact mitigation factor (from [1]):
------------------------------------------
One of the restrictions on the this is that the amount the buffer can be
overflowed by is limited to the amount of data that can be transported in 
one TCP packet, as any following TCP packets are treated as file data and 
won't be reassembled as part of the first packet.

Comment 1 Jan Lieskovsky 2010-11-23 19:22:03 UTC
This issue did NOT affect the versions of the wireshark package,
as shipped with Red Hat Enterprise Linux 4 and 5, as those versions
do not include support for Local Download Sharing Service (LDSS)
protocol yet.

This issue affects the version of the wireshark package, as shipped
with Red Hat Enterprise Linux 6.

--

This issue affects the version of the wireshark package, as shipped
with Fedora release of 12.

This issue does NOT affect the versions of the wireshark package,
as shipped with Fedora release of 13 and 14 (relevant packages
were already updated, though they may be currently present in
-testing repository yet).

Comment 3 Jan Lieskovsky 2010-11-23 19:40:02 UTC
Created wireshark tracking bugs for this issue

Affects: fedora-12 [bug 656463]

Comment 6 errata-xmlrpc 2010-11-30 18:32:43 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2010:0924 https://rhn.redhat.com/errata/RHSA-2010-0924.html

Comment 7 Vincent Danen 2010-11-30 18:54:30 UTC
Statement:

This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 4 and 5 as they did not include support for the Local Download Sharing Service (LDSS) protocol.

This issue was addressed in Red Hat Enterprise Linux 6 via
https://rhn.redhat.com/errata/RHSA-2010-0924.html.


Note You need to log in before you can comment on or make changes to this bug.