Info

Disclosure

Jul 17, 2006

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

A remote overflow exists in the Wireshark NMAS dissector. The application fails to properly iterate over a buffer resulting in a off-by-one overflow. With a specially crafted packet, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Unknown
Disclosure: OSVDB Verified

Solution

Upgrade to version 0.99.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Gerald Combs

Wireshark

0.99.0

References

Bugtraq ID: 19051
CVE ID: 2006-3630 (see also: NVD)
Secunia Advisory ID: 21078 21107
Related OSVDB ID: 27360 27361 27362 27363 27364 27365 27366 27368 27369 27370 27371
ISS X-Force ID: 27827
Keyword: formerly ethereal wnpa-sec-2006-01
Other Advisory URL: http://www.mandriva.com/security/advisories?name=MDKSA-2006:128
Vendor Specific Advisory URL: http://www.wireshark.org/security/wnpa-sec-2006-01.html

Credit

Ilja van Sprundel -

Direct URL: http://osvdb.org/27367