News
Vigil@nce: Wireshark, denial of service via fragments
July 2008 by Vigil@nce
SYNTHESIS
An attacker can send a sequence of fragmented packets in order to
stop Wireshark.
Gravity: 1/4
Consequences: denial of service of service
Provenance: internet client
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by a trusted third party (4/5)
Diffusion of the vulnerable configuration: high (3/3)
Creation date: 11/07/2008
Identifier: VIGILANCE-VUL-7945
IMPACTED PRODUCTS
– Unix - plateform
DESCRIPTION
The Wireshark/Ethereal program captures packets, in order to help
administrator solving network problems.
When TCP data are fragmented in several IP packets, Wireshark
stores them to reassemble them. However, in some cases, the
fragment_add_work() function reads after the end of stored data,
which creates a segmentation error.
An attacker can therefore send a sequence of fragmented packets in
order to stop Wireshark.
CHARACTERISTICS
Identifiers: VIGILANCE-VUL-7945, wnpa-sec-2008-04
