7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.008 Low
EPSS
Percentile
81.1%
The version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.2. It is, therefore, affected by multiple vulnerabilities in the following components, which can result in a memory disclosure, a denial of service, or the execution of arbitrary code :
Additionally, a flaw related to how dynamic-link library (DLL) files are located and loaded exists in the ui/qt/wireshark_application.cpp file due to the application using a DLL search path that may include directories that are not trusted or under the user’s control. A local attacker can exploit this issue, via a crafted DLL file injected into the search path, to execute arbitrary code with the privileges of the user running the application.
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(89104);
script_version("1.12");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/03/09");
script_cve_id(
"CVE-2016-2521",
"CVE-2016-2522",
"CVE-2016-2523",
"CVE-2016-2524",
"CVE-2016-2525",
"CVE-2016-2526",
"CVE-2016-2527",
"CVE-2016-2528",
"CVE-2016-2529",
"CVE-2016-2530",
"CVE-2016-2531",
"CVE-2016-2532",
"CVE-2016-4415",
"CVE-2016-4416",
"CVE-2016-4417",
"CVE-2016-4418",
"CVE-2016-4419",
"CVE-2016-4420",
"CVE-2016-4421"
);
script_xref(name:"EDB-ID", value:"38996");
script_xref(name:"EDB-ID", value:"39490");
script_name(english:"Wireshark 2.0.x < 2.0.2 Multiple Vulnerabilities");
script_summary(english:"Checks the version of Wireshark.");
script_set_attribute(attribute:"synopsis", value:
"The remote Windows host has an application installed that is affected
by multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The version of Wireshark installed on the remote Windows host is
2.0.x prior to 2.0.2. It is, therefore, affected by multiple
vulnerabilities in the following components, which can result in a
memory disclosure, a denial of service, or the execution of arbitrary
code :
- 3GPP TS 32.423 Trace file parser
- ASN.1 BER dissector
- DNP dissector
- GSM A-bis OML dissector
- HiQnet dissector
- HTTP/2 dissector
- IEEE 802.11 dissector
- iSeries file parser
- Ixia IxVeriWave file parser
- LBMC dissector
- LLRP dissector
- NFS dissector
- RSL dissector
- SPICE dissector
- X.509AF dissector
Additionally, a flaw related to how dynamic-link library (DLL) files
are located and loaded exists in the ui/qt/wireshark_application.cpp
file due to the application using a DLL search path that may include
directories that are not trusted or under the user's control. A local
attacker can exploit this issue, via a crafted DLL file injected into
the search path, to execute arbitrary code with the privileges of the
user running the application.
Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html");
script_set_attribute(attribute:"solution", value:
"Upgrade to Wireshark version 2.0.2 or later.");
script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-2521");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploit_framework_core", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2015/12/12");
script_set_attribute(attribute:"patch_publication_date", value:"2016/02/26");
script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/03");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:wireshark:wireshark");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Windows");
script_copyright(english:"This script is Copyright (C) 2016-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("wireshark_installed.nasl");
script_require_keys("installed_sw/Wireshark");
exit(0);
}
include('vcf.inc');
get_kb_item_or_exit('SMB/Registry/Enumerated');
var app_info = vcf::get_app_info(app:'Wireshark', win_local:TRUE);
var constraints = [
{ 'min_version' : '2.0.0', 'max_version' : '2.0.1', 'fixed_version' : '2.0.2' }
];
vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2521
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2522
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2523
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2524
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2525
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2526
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2527
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2528
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2529
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2530
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2531
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2532
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4415
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4416
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4417
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4418
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4419
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4420
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4421
www.wireshark.org/docs/relnotes/wireshark-2.0.2.html
7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.008 Low
EPSS
Percentile
81.1%