| VID |
50148 |
| Severity |
40 |
| Port |
139,445 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
The version of Wireshark installed on the remote Windows host is 2.2.x prior to 2.2.12. It is, therefore, affected by a denial of service vulnerability.
- In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. This was addressed in epan/dissectors/packet-mrdisc.c by validating an IPv4 address. This vulnerability is similar to CVE-2017-9343. (CVE-2017-17997)
- In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by correcting the signature timestamp bounds checks.(CVE-2018-5334)
- In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the WCP dissector could crash. This was addressed in epan/dissectors/packet-wcp.c by validating the available buffer length.(CVE-2018-5335)
- In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the JSON, XML, NTP, XMPP, and GDB dissectors could crash. This was addressed in epan/tvbparse.c by limiting the recursion depth.(CVE-2018-5336)
* Note: This check requires an account with administrative privileges which can log into the host to scan. Absence of this condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* References:
https://www.wireshark.org/security/wnpa-sec-2018-01.html
https://www.wireshark.org/security/wnpa-sec-2018-03.html
https://www.wireshark.org/security/wnpa-sec-2018-04.html
* Platforms Affected:
Wireshark versions 2.2.x prior to 2.2.12
Microsoft Windows Any version |
| Recommendation |
Upgrade to the latest version Wireshark (2.2.12 or later), available from the Wireshark.org Web site at http://www.wireshark.org/download/win32/all-versions/ |
| Related URL |
CVE-2017-17997,CVE-2018-5334,CVE-2018-5335,CVE-2018-5336 (CVE) |
| Related URL |
102499,102500,102504 (SecurityFocus) |
| Related URL |
(ISS) |
|
