SB2016100405 - Denial of service in Wireshark

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Denial of service (CVE-ID: N/A)

The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness is due to insufficient input validation. By transmitting a specially crafted data packets to the target system or convincing a victim to open a crafted packet trace file, attackers can cause Wireshark Bluetooth L2CAP dissector to crash.
Successful exploitation of the vulnerability will result in denial of service on the vulnerable system.

2) Denial of service (CVE-ID: N/A)

The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness is due to insufficient input validation. By transmitting a specially crafted data packets to the target system or convincing a victim to open a crafted packet trace file, attackers can cause NCP dissector to crash.
Successful exploitation of the vulnerability will result in denial of service on the vulnerable system.

Remediation

Install update from vendor's website.

References

• https://www.wireshark.org/security/wnpa-sec-2016-56.html
• https://www.wireshark.org/security/wnpa-sec-2016-57.html