Wireshark ICMPv6 parser Infinite Loop Vulnerability

Release date:
Updated on: 2012-12-02

Affected Systems:
Wireshark 1.x
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2012-5602

Wireshark (formerly known as Ethereal) is a very popular open-source network traffic analysis software.

Wireshark 1.6.0-1.6.11, 1.8.0-1.8.3 the function dissect_icmpv6 in epan/dissectors/packet-icmpv6.c in the ICMPv6 parser has a security vulnerability. Through specially crafted packets, remote attackers can cause DOS.

<* Source: Wireshark (http://www.wireshark.org /)

Link: https://bugzilla.RedHat.com/show_bug.cgi? Id = 881701
Http://secunia.com/advisories/51422/
Http://www.wireshark.org/security/wnpa-sec-2012-40.html
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Wireshark (http://www.wireshark.org/) provides the following testing methods:
For more information about pcap packages, see
Http://www.wireshark.org/download/automated/captures/fuzz-2012-10-10-4301.pcap

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Wireshark
---------
Wireshark has released a Security Bulletin (wnpa-sec-2012-40) and corresponding patches for this:

Wnpa-sec-2012-40: Name: Wireshark ICMPv6 dissector infinite loop

Link: http://www.wireshark.org/security/wnpa-sec-2012-40.html

For repairs, see:
Http://anonsvn.wireshark.org/viewvc? View = revision & revision = 45459

For more information about downloading the new version, see:
Http://www.wireshark.org/download.html