Korean
<< Back
VID 28268
Severity 40
Port 139,445
Protocol TCP
Class SMB
Detailed Description A version of Wireshark which is older than 1.2.6 has been installed on the host. Wireshark is a free packet analyzer computer application. The installed version of Wireshark or Ethereal is potentially vulnerable to attack by handling data associated with the LWRES dissector.

These vulnerabilities can result in a denial of service, or possibly arbitrary code execution. A remote attacker can exploit these issues by tricking a user into opening a maliciously crafted capture file. Additionally, if Wireshark is running in promiscuous mode, one of these issues can be exploited remotely.

* Note: This check requires an account with administrative privileges which can log into the host to scan. Absence of this condition will result in the check not being performed and a False Negative for all vulnerable hosts.

* References:
http://www.wireshark.org/security/wnpa-sec-2010-02.html

* Platforms Affected:
Wireshark versions prior to 1.2.6 (from 0.9.0 to 1.2.5)
Microsoft Windows Any version
Recommendation Upgrade to the latest version Wireshark (1.2.6 or later), available from the Wireshark.org Web site at http://www.wireshark.org/download.html

If are running Wireshark 1.2.5 or earlier (including Ethereal) and cannot upgrade, you can work around each of the problems listed above by doing the following:
- Disable the LWRES dissector:
O Select Analyze¡æEnabled Protocols... from the menu.
O Make sure "LWRES" is un-checked.
O Click "Save", then click "OK".
Related URL CVE-2010-0304 (CVE)
Related URL 37985 (SecurityFocus)
Related URL (ISS)