SB2016111702 - Input validation error in Wireshark
Published: November 17, 2016 Updated: March 24, 2022
Security Bulletin ID
SB2016111702
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2016-9374)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can create a buffer over-read, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-alljoyn.c by ensuring that a length variable properly tracked the state of a signature variable, pass it to the affected application and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- http://www.debian.org/security/2016/dsa-3719
- http://www.securityfocus.com/bid/94369
- http://www.securitytracker.com/id/1037313
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12953
- https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=a5770b6559b6e6765c4ef800e85ae42781ea4900
- https://www.wireshark.org/security/wnpa-sec-2016-59.html