The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c (CVE-2018-6836)

  - The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x     before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a     denial of service (application crash) via a crafted packet. (CVE-2014-2907)

  - The dissect_frame function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark     1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to     represent an error condition, which allows remote attackers to cause a denial of service (application     crash) via a crafted packet. (CVE-2014-4020)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c (CVE-2018-6836)

  - Stack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x     through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of service (infinite     loop) via vectors involving self-referential ASN.1 CHOICE values. (CVE-2011-1142)

  - Multiple integer overflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers     to cause a denial of service (infinite loop) via vectors related to the (1) BACapp and (2) Bluetooth HCI     dissectors, a different vulnerability than CVE-2012-2392. (CVE-2012-3825)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wireshark: free operation on an uninitialized memory address in wiretap/netmon.c (CVE-2018-6836)

  - Stack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x     through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of service (infinite     loop) via vectors involving self-referential ASN.1 CHOICE values. (CVE-2011-1142)

  - The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table     searches for empty strings, which allows remote attackers to cause a denial of service (application crash)     via a crafted packet, related to the (1) dissector_get_string_handle and (2)     dissector_get_default_string_handle functions. (CVE-2015-6243)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
199503	RHEL 7 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical
199535	RHEL 5 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical
199531	RHEL 6 : wireshark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical

検出

プラグインの検索

critical

critical

critical