[CVE 2008-468[1-5] - Wireshark up to 1.0.3 affected by multiple security vulnerabilities

[Stefan Lesicnik]

Binary package hint: wireshark

CVE-2008-4680
packet-usb.c in the USB dissector in Wireshark 0.99.7 through 1.0.3 allows
remote attackers to cause a denial of service (application crash or abort)
via a malformed USB Request Block (URB).
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4680

CVE-2008-4681
Unspecified vulnerability in the Bluetooth RFCOMM dissector in Wireshark
0.99.7 through 1.0.3 allows remote attackers to cause a denial of service
(application crash or abort) via unknown packets.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4681

CVE-2008-4682
wtap.c in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a
denial of service (application abort) via a malformed Tamos CommView
capture file (aka .ncf file) with an "unknown/unexpected packet type" that
triggers a failed assertion.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4682

CVE-2008-4683
The dissect_btacl function in packet-bthci_acl.c in the Bluetooth ACL
dissector in Wireshark 0.99.2 through 1.0.3 allows remote attackers to
cause a denial of service (application crash or abort) via a packet with an
invalid length, related to an erroneous tvb_memcpy call.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4683

CVE-2008-4684
packet-frame in Wireshark 0.99.2 through 1.0.3 does not properly handle
exceptions thrown by post dissectors, which allows remote attackers to
cause a denial of service (application crash) via a certain series of
packets, as demonstrated by enabling the (1) PRP or (2) MATE post
dissector.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4684

CVE-2008-4685
Use-after-free vulnerability in the dissect_q931_cause_ie function in
packet-q931.c in the Q.931 dissector in Wireshark 0.10.3 through 1.0.3
allows remote attackers to cause a denial of service (application crash or
abort) via certain packets that trigger an exception.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4685

[Stefan Lesicnik (stefanlsd)]

As per the CVE's. All releases up to 1.0.3 are affected by these bugs. These POC are taken from the original wireshark bug tracker and just renamed to easier identify which belongs to which CVE.

All of these bugs were always reproducible, except for CVE_2008-4685 which happened intermittently.

I also built a test build to remove wiresharks memory overflow and underflow detection and protection routine as some of these are actually trapped there. More details: http://wiki.wireshark.org/Development/Canary

To reproduce (tested on current Intrepid version 1.0.3 - will test others)

For each test with EP_DEBUG_FREE and SE_DEBUG_FREE defined.

- 2008-4680 - Open the attached .pcap file.
- 2008-4681 - Open the attached .pcap file.
- 2008-4682 - Open the attached .ncf file.
- 2008-4683 - Open the attached .pcap file twice.
- 2008-4684 - Open the attached .pcap file.
                       Click Analyze - Enabled Protocols - Disable all protocols - Apply - Ok
                       Click Analyze - Enabled Protocols - Enable all protocols - Apply - Ok
- 2008-4685 - This crash was intermittent. Ensure packet colourization is on. Open the main .pcap file, open the 1 and 2 version. And then the main again. Sometimes would crash. From the author of the patch - "Still, it's a dangling pointer we're dealing with here, so it may all come down to the specifics of the platform and compiler as to how the bug hits" - More details can be found here - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2870

[Stefan Lesicnik (stefanlsd)]

Intrepid debdiff attached.

I am in contact with the Debian maintainer and will forward all relevant patches.

[Stefan Lesicnik (stefanlsd)]

Gutsy includes 0.99.6 of Wireshark and CVE-2008-4685 should not apply according the CVE description, although using the attached CVE POC exploit, it was possible to segfault Wireshark. After applying the fix for CVE 2008-4685 the segfault no longer occured.

[Xavier Aragon (xarax-lp)]

Could someone please comment on the progress of resolving this bug. I use wireshark in Intrepid and I'm a bit worried about these vulnerabilities. Thanks.

[Stefan Lesicnik (stefanlsd)]

Hi.

These patches should be complete. I think Debian has merged them already. I will see if I can get an admin to upload these.

[Kees Cook (kees)]

Thanks for these debdiffs! Have the resulting builds been tests on each release as well?

[Kees Cook (kees)]

Fixed in Jaunty via Debian merge.

[Kees Cook (kees)]

I've uploaded these for building in the security queue. Once they are ready, we can put them through -proposed and finally into -security. Thanks again!

https://launchpad.net/~ubuntu-security-proposed/+archive

[Jamie Strandboge (jdstrand)]

These are all in proposed, please test and give feedback here. Please see https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

[Jamie Strandboge (jdstrand)]

Can people from motu-swat test these proposed wireshark packages? Thanks in advance!

[Rolf Leggewie (r0lf)]

I'd be happy to test the proposed packages, except I would not know how. There is no test-case. I could install the packages and report whether that goes smoothly or not. But I don't think that kind of feedback to be sufficient.

[Andreas Wenning (andreas-wenning)]

Marking as fix released, as the packages are already copied to -updates and -security.