bugtraq - Wireshark 1.4.0 Malformed SNMP V1 Packet Denial of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 13 Sep 2010 05:42:10 -0000
From: yangdn@...c.org.cn
To: bugtraq@...urityfocus.com
Subject: Wireshark 1.4.0 Malformed SNMP V1 Packet Denial of Service

Wireshark 1.4.0 Malformed SNMP V1 Packet Denial of Service

------------------------------------------------------------------
I. Summary

A flaw has been identified in Wireshark 1.4.0 concerning the ASN.1/BER dissector that will cause a denial of service (stack overflow and null pointer dereference in exception handling code).

------------------------------------------------------------------
II. Description

Wireshark makes use of protocol dissectors to parse packet data and organize its contents into a meaningful representation. Upon encountering an SNMP v1 packet, the ASN.1/BER dissector, as implemented in $SRC_ROOT/epan/dissectors/packet-ber.c, will be invoked to process the BER encoded content, i.e. variable bindings in the SNMP PDU. If this field is filled with an extremely long string,  e.g. a sequence of 14000 'A's, a recursive call in function dissect_unknown_ber() would consume too much stack space, causing stack overflow in most configurations and later a null pointer deference in the exception handling code.

------------------------------------------------------------------
III. Impact

Denial of service (null pointer deference and application crash)

------------------------------------------------------------------
IV. Affected

Wireshark 1.4.0, tested with Windows XP SP2. Previous versions may also be affected due to code reuse.

------------------------------------------------------------------
V. Solution

Since the ASN.1/BER dissector is used by several protocol dissectors, it may be inadequate to disable SNMP protocol dissection only. There is no known workaround at this time.

------------------------------------------------------------------
VI. Credit

The penetration test team Of NCNIPC (China) is credited for this vulnerability.