Wireshark updates close DoS security holes
Versions 1.6.8 and 1.4.13 of the open source Wireshark network protocol analyser have been released, fixing bugs and closing security holes. The maintenance and security updates to the cross-platform tool address a total of three vulnerabilities that could be exploited by an attacker to cause a denial-of-service (DoS).
These include a memory allocation flaw in the DIAMETER dissector, infinite and large loops in eight other dissectors, and a memory alignment flaw when running on SPARC or Itanium processors. For an attack to be successful, an attacker must inject a malformed packet onto the wire or convince a victim to read a malformed packet trace file. Versions 1.4.0 to 1.4.12 and 1.6.0 to 1.6.7 are affected; upgrading to 1.4.13 or 1.6.8 corrects these problems.
A full list of changes and bug fixes in the updates can be found in the 1.4.13 and 1.6.8 release notes. Wireshark 1.4.13 and 1.6.8 are available to download from the project's site and are licensed under the GPLv2.
See also:
- Infinite and large loops in many dissectors, a Wireshark security advisory.
- Wireshark DIAMETER memory allocation flaw, a Wireshark security advisory.
- Wireshark memory alignment flaw, a Wireshark security advisory.
(crve)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
