Wireshark RTCP parser Infinite Loop Vulnerability

Release date:
Updated on: 2012-12-02

Affected Systems:
Wireshark 1.x
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2012-5600

Wireshark (formerly known as Ethereal) is a very popular open-source network traffic analysis software.

Wireshark 1.6.0-1.6.11, 1.8.0-1.8.3 RTCP parser in the epan/dissectors/packet-rtcp.c function dissect_rtcp_app security vulnerability, through specially crafted packets, can allow remote attackers to cause DOS.

<* Source: Wireshark (http://www.wireshark.org /)

Link: https://bugzilla.RedHat.com/show_bug.cgi? Id = 881742
Http://secunia.com/advisories/51422/
Http://www.wireshark.org/security/wnpa-sec-2012-38.html
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Wireshark (http://www.wireshark.org/) provides the following testing methods:
For more information about pcap packages, see
Http://www.wireshark.org/download/automated/captures/fuzz-2012-10-19-32463.pcap

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Wireshark
---------
Wiresharkhas published a Security Bulletin Board (wnpa-sec-2012-38.html) and corresponding patches for this purpose:

Wnpa-sec-2012-38.html: Name: Wireshark RTCP dissector inifinte loop

Link: http://www.wireshark.org/security/wnpa-sec-2012-38.html

For repairs, see:
Http://anonsvn.wireshark.org/viewvc? View = revision & revision = 45717

For more information about downloading the new version, see:
Http://www.wireshark.org/download.html