Re: CVE request: Wireshark multiple vulnerabilities

["Steven M. Christey" <coley () rcf-smtp mitre org>]

On Wed, 11 Jan 2012, Kurt Seifried wrote:

> On 01/11/2012 09:19 AM, Agostino Sarubbo wrote:
> > According to secunia advisory: https://secunia.com/advisories/47494/ :
> >
> > Multiple vulnerabilities have been reported in Wireshark, which can be
> > exploited by malicious people to cause a DoS (Denial of Service) and
> > compromise a user's system.
> >
> > 1) NULL pointer dereference errors when reading certain packet information can
> > be exploited to cause a crash.

In this case, if a network monitor can be crashed, an attacker might be 
able to launch an attack undetected.  As such, NULL pointer dereferences 
and other crashers in security-relevant products often count for CVEs, so 
Kurt, please assign one for this.

See http://www.openwall.com/lists/oss-security/2011/09/14/9 for further 
explanation from me.

- Steve