=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2009/VULN545
_____________________________________________________________________

DATE                      : 18/12/2009

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Wireshark versions 0.9.0 up
                              to and including 1.2.4.

======================================================================
http://www.wireshark.org/security/wnpa-sec-2009-09.html
______________________________________________________________________

Summary

Name:Multiple vulnerabilities in Wireshark® version 0.9.0 to 1.2.4

Docid: wnpa-sec-2009-09

Date: December 17, 2009

Versions affected: 0.9.0 up to and including 1.2.4
Details
Description

Wireshark 1.2.5 fixes the following vulnerabilities:

    * The Daintree SNA file parser could overflow a buffer. (Bug 4294)
      Versions affected: 1.2.0 to 1.2.4
    * The SMB and SMB2 dissectors could crash. (Bug 4301)
      Versions affected: 0.9.0 to 1.2.4
    * The IPMI dissector could crash on Windows. (Bug 4319)
      Versions affected: 1.2.0 to 1.2.4

Impact

It may be possible to make Wireshark crash remotely or by convincing
someone to read a malformed packet trace file.


Resolution

Upgrade to Wireshark 1.2.5 or later. Due to the nature of the Daintree
SNA vulnerability, there is no workaround.


======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================