Bug 1010740 - (CVE-2016-9375) VUL-0: CVE-2016-9375: wireshark: Wireshark DTN dissector could go into an infinite loop
(CVE-2016-9375)
VUL-0: CVE-2016-9375: wireshark: Wireshark DTN dissector could go into an inf...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Lingshan Zhu
Security Team bot
https://smash.suse.de/issue/176452/
CVSSv2:NVD:CVE-2016-9375:4.3:(AV:N/AC...
:
Depends on:
Blocks: 1010911
  Show dependency treegraph
 
Reported: 2016-11-17 15:35 UTC by Matthias Gerstner
Modified: 2018-11-27 13:18 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
capture file to reproduce the issue (9.96 KB, application/vnd.tcpdump.pcap)
2016-11-17 15:37 UTC, Matthias Gerstner
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Gerstner 2016-11-17 15:35:14 UTC
CVE-2016-9375

In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DTN dissector could go into
an infinite loop, triggered by network traffic or a capture file. This was
addressed in epan/dissectors/packet-dtn.c by checking whether SDNV evaluation
was successful.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9375
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-9375.html
https://www.wireshark.org/security/wnpa-sec-2016-62.html
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=be6a10afc59f8182b9884d02f9857d547539fe8a
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13097
Comment 1 Matthias Gerstner 2016-11-17 15:36:21 UTC
SLE10-SP3 is not affected, because it doesn't contain the code in question. Seems to be a feature of the DTN dissector that was added later on.
Comment 2 Matthias Gerstner 2016-11-17 15:37:44 UTC
Created attachment 702487 [details]
capture file to reproduce the issue

QA reproducer: Run the attached capture file in wireshark/tshark. If the bug triggers wireshark will stop responding, eat 100 % CPU and might crash after some time due to an out of memory situation.
Comment 3 Bernhard Wiedemann 2016-11-17 21:00:29 UTC
This is an autogenerated message for OBS integration:
This bug (1010740) was mentioned in
https://build.opensuse.org/request/show/440739 Factory / wireshark
https://build.opensuse.org/request/show/440743 42.2 / wireshark
Comment 4 Swamp Workflow Management 2016-11-17 23:01:09 UTC
bugbot adjusting priority
Comment 5 Lingshan Zhu 2016-11-21 08:26:46 UTC
a new version wireshark 2.2.2 can build for SLE12, but whether update to 2.2.2 depends on fate#321770, see https://fate.suse.com/321770
Comment 6 Swamp Workflow Management 2016-11-27 14:07:19 UTC
openSUSE-SU-2016:2923-1: An update that solves 5 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1010735,1010740,1010752,1010754,1010807,1010911
CVE References: CVE-2016-9372,CVE-2016-9373,CVE-2016-9374,CVE-2016-9375,CVE-2016-9376
Sources used:
openSUSE Leap 42.2 (src):    wireshark-2.2.2-3.1
Comment 7 Lingshan Zhu 2017-05-02 02:41:48 UTC
resolved by the latest update
Comment 8 Swamp Workflow Management 2017-05-04 13:10:03 UTC
SUSE-SU-2017:1174-1: An update that solves 23 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1002981,1010735,1010740,1010752,1010754,1010911,1021739,1025913,1027998,1033936,1033937,1033938,1033939,1033940,1033941,1033942,1033943,1033944,1033945,998761,998762,998763,998800,998963,998964
CVE References: CVE-2016-7175,CVE-2016-7176,CVE-2016-7177,CVE-2016-7178,CVE-2016-7179,CVE-2016-7180,CVE-2016-9373,CVE-2016-9374,CVE-2016-9375,CVE-2016-9376,CVE-2017-5596,CVE-2017-5597,CVE-2017-6014,CVE-2017-7700,CVE-2017-7701,CVE-2017-7702,CVE-2017-7703,CVE-2017-7704,CVE-2017-7705,CVE-2017-7745,CVE-2017-7746,CVE-2017-7747,CVE-2017-7748
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    wireshark-2.0.12-36.1
SUSE Linux Enterprise Server 11-SP4 (src):    wireshark-2.0.12-36.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    wireshark-2.0.12-36.1
Comment 9 Swamp Workflow Management 2017-05-30 16:11:04 UTC
SUSE-SU-2017:1442-1: An update that solves 24 vulnerabilities and has four fixes is now available.

Category: security (moderate)
Bug References: 1002981,1010735,1010740,1010752,1010754,1010911,1021739,1025913,1026507,1027692,1027998,1033936,1033937,1033938,1033939,1033940,1033941,1033942,1033943,1033944,1033945,990856,998761,998762,998763,998800,998963,998964
CVE References: CVE-2016-6354,CVE-2016-7175,CVE-2016-7176,CVE-2016-7177,CVE-2016-7178,CVE-2016-7179,CVE-2016-7180,CVE-2016-9373,CVE-2016-9374,CVE-2016-9375,CVE-2016-9376,CVE-2017-5596,CVE-2017-5597,CVE-2017-6014,CVE-2017-7700,CVE-2017-7701,CVE-2017-7702,CVE-2017-7703,CVE-2017-7704,CVE-2017-7705,CVE-2017-7745,CVE-2017-7746,CVE-2017-7747,CVE-2017-7748
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    wireshark-2.2.6-44.3
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    wireshark-2.2.6-44.3
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    wireshark-2.2.6-44.3
SUSE Linux Enterprise Server 12-SP2 (src):    wireshark-2.2.6-44.3
SUSE Linux Enterprise Server 12-SP1 (src):    wireshark-2.2.6-44.3
SUSE Linux Enterprise Desktop 12-SP2 (src):    wireshark-2.2.6-44.3
SUSE Linux Enterprise Desktop 12-SP1 (src):    wireshark-2.2.6-44.3