Some vulnerabilities have been reported in Wireshark, which can be exploited by malicious people to cause a DoS (Denial of Service).

1) An alignment error within the "dissect_paltalk()" function in epan/dissectors/packet-paltalk.c of the Paltalk dissector can be exploited to cause a crash.

Note: Successful exploitation requires that Wireshark is running on an alignment sensitive architecture.

The vulnerability is reported in versions 1.2.0 through 1.2.2.

2) A NULL pointer dereference error within the DCERPC/NT dissector when can be exploited to cause a crash.

The vulnerability is reported in versions 0.10.10 through 1.2.2.

3) An off-by-one error within the "dissect_negprot_response()" function in epan/dissectors/packet-smb.c of the SMB dissector can be exploited to cause a crash.

The vulnerability is reported in versions 1.2.0 through 1.2.2.

4) An error within the RADIUS dissector can be exploited to cause a crash.

The is vulnerability is reported in version 0.10.13 through 1.0.9 (previously reported in version 1.2.0 only).

Solution
Update to version 1.0.10 or 1.2.3.
Further details available in Customer Area

Provided and/or discovered by
Reported by the vendor.

Original Advisory
WNPA-SEC-2009-07:
http://www.wireshark.org/security/wnpa-sec-2009-07.html

WNPA-SEC-2009-08:
http://www.wireshark.org/security/wnpa-sec-2009-08.html

Deep Links
Links available in Customer Area