CVE-2011-1140 Multiple stack consumption vulnerabilities in the dissect_ms_compressed_string and dissect_mscldap_string functions in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 allow remote attac...
MediumCVSS 4.3
EPSS 13.1%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple stack consumption vulnerabilities in the dissect_ms_compressed_string and dissect_mscldap_string functions in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 allow remote attackers to cause a denial of service (infinite recursion) via a crafted (1) SMB or (2) Connection-less LDAP (CLDAP) packet.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wireshark | = 1.0 | No fix listed |
| wireshark | = 1.0.0 | No fix listed |
| wireshark | = 1.0.1 | No fix listed |
| wireshark | = 1.0.2 | No fix listed |
| wireshark | = 1.0.3 | No fix listed |
| wireshark | = 1.0.4 | No fix listed |
| wireshark | = 1.0.5 | No fix listed |
| wireshark | = 1.0.6 | No fix listed |
| wireshark | = 1.0.7 | No fix listed |
| wireshark | = 1.0.8 | No fix listed |
| wireshark | = 1.0.9 | No fix listed |
| wireshark | = 1.0.10 | No fix listed |
| wireshark | = 1.0.11 | No fix listed |
| wireshark | = 1.0.12 | No fix listed |
| wireshark | = 1.0.13 | No fix listed |
| wireshark | = 1.0.14 | No fix listed |
| wireshark | = 1.0.15 | No fix listed |
| wireshark | = 1.0.16 | No fix listed |
| wireshark | = 1.2.0 | No fix listed |
| wireshark | = 1.2.1 | No fix listed |
| wireshark | = 1.2.2 | No fix listed |
| wireshark | = 1.2.3 | No fix listed |
| wireshark | = 1.2.4 | No fix listed |
| wireshark | = 1.2.5 | No fix listed |
| wireshark | = 1.2.6 | No fix listed |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| wireshark | = 1.2.7 | No fix listed |
| wireshark | = 1.2.8 | No fix listed |
| wireshark | = 1.2.9 | No fix listed |
| wireshark | = 1.2.10 | No fix listed |
| wireshark | = 1.2.11 | No fix listed |
| wireshark | = 1.2.12 | No fix listed |
| wireshark | = 1.2.13 | No fix listed |
| wireshark | = 1.2.14 | No fix listed |
| wireshark | = 1.4.0 | No fix listed |
| wireshark | = 1.4.1 | No fix listed |
| wireshark | = 1.4.2 | No fix listed |
| wireshark | = 1.4.3 | No fix listed |
| debian/wireshark(Debian:12) | < 1.4.4-1 | 1.4.4-1 |
| debian/wireshark(Debian:13) | < 1.4.4-1 | 1.4.4-1 |
| debian/wireshark(Debian:14) | < 1.4.4-1 | 1.4.4-1 |
References
- Debian Security Tracker CVE-2011-1140 vendor-advisory
- anonsvn.wireshark.org patch
- FEDORA-2011-2648 vendor-advisory
- FEDORA-2011-2632 vendor-advisory
- FEDORA-2011-2620 vendor-advisory
- 43759 third-party-advisory
- 43795 third-party-advisory
- 43821 third-party-advisory
- 44169 third-party-advisory
- DSA-2201 vendor-advisory
- VU#215900 third-party-advisory us-government-resource
- MDVSA-2011:044 vendor-advisory
- RHSA-2011:0369 vendor-advisory
- RHSA-2011:0370 vendor-advisory
- 1025148 vdb-entry
- ADV-2011-0622 vdb-entry
- ADV-2011-0626 vdb-entry
- ADV-2011-0719 vdb-entry
- ADV-2011-0747 vdb-entry
- www.wireshark.org patch
- www.wireshark.org patch
- www.wireshark.org vendor-advisory
- www.wireshark.org vendor-advisory
- bugs.wireshark.org exploit
- openSUSE-SU-2011:0347 vendor-advisory
- oval:org.mitre.oval:def:14715 signature vdb-entry