Fortinet Discovers Memory Corruption In Wireshark Bluetooth HCI
Fortinet's FortiGuard Labs has discovered memory corruption vulnerability in Wireshark Bluetooth HCI.
SolutionsUpgrade to latest version available from http://www.wireshark.org/download.html.
The Bluetooth HCI memory corruption vulnerability lies in the BTHCI packet dissector and is caused by insufficient checking of packet parameters. This issue occurs either when Wireshark is configured to sniff Bluetooth traffic (with an USB dongle for example) and sent "live" malicious traffic, or upon opening a crafted Bluetooth HCI encapsulation format traffic file.
The Parallel Redundancy Protocol post-dissector (not enabled by default) is vulnerable to a denial of service when handling specially crafted Ethernet frames; the issue is caused by a missing exception handling.
The USB URB denial of service vulnerability lies in the USB packet dissector, where insufficient checking of packet parameters is performed; the vulnerability is present only when Wireshark is configured to sniff packets from USB ports or opens a crafted USB traffic pcap file.
The two denial of service conditions above may be used by an attacker as a Cyber Counter-Measures tool, in order to render the network surveillance systems "blind" before engaging in further deleterious action.
David Maciejak of Fortinet's FortiGuard Global Security Research Team