| VID |
50161 |
| Severity |
40 |
| Port |
139,445 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
The version of Wireshark installed on the remote Windows host is 2.4.x prior to 2.4.5. It is, therefore, affected by multiple denial of service vulnerabilities.
- IEEE 802.11, UMTS MAC, DOCSIS, FCP, SIGCOMP, IPMI, SIGCOMP, NBAP dissector could crash.
- pcapng file parser could crash
- Multiple dissectors could go into large infinite loops. All ASN.1 BER dissectors, along with the DICOM, DMP, LLTD, OpenFlow, RELOAD, RPCoRDMA, RPKI-Router, S7COMM, SCCP, Thread, Thrift, USB, and WCCP dissectors were susceptible.
* Note: This check requires an account with administrative privileges which can log into the host to scan. Absence of this condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* References:
https://www.wireshark.org/security/wnpa-sec-2018-05.html
https://www.wireshark.org/security/wnpa-sec-2018-06.html
https://www.wireshark.org/security/wnpa-sec-2018-07.html
https://www.wireshark.org/security/wnpa-sec-2018-08.html
https://www.wireshark.org/security/wnpa-sec-2018-09.html
https://www.wireshark.org/security/wnpa-sec-2018-10.html
https://www.wireshark.org/security/wnpa-sec-2018-11.html
https://www.wireshark.org/security/wnpa-sec-2018-12.html
https://www.wireshark.org/security/wnpa-sec-2018-13.html
https://www.wireshark.org/security/wnpa-sec-2018-14.html
* Platforms Affected:
Wireshark versions 2.4.x prior to 2.4.5
Microsoft Windows Any version |
| Recommendation |
Upgrade to the latest version Wireshark (2.4.5 or later), available from the Wireshark.org Web site at http://www.wireshark.org/download/win32/all-versions/ |
| Related URL |
CVE-2018-7320,CVE-2018-7321,CVE-2018-7322,CVE-2018-7323,CVE-2018-7324,CVE-2018-7325,CVE-2018-7326,CVE-2018-7327,CVE-2018-7328,CVE-2018-7329 (CVE) |
| Related URL |
103158,103160,103162,103164,103165,103166 (SecurityFocus) |
| Related URL |
(ISS) |
|
