Wireshark 1.4.0 Malformed IKE Packet Denial of Service

[vuln@xxxxxxxxxxx]

Wireshark 1.4.0 Malformed IKE Packet Denial of Service

------------------------------------------------------------------
I. Summary

A flaw has been identified in Wireshark 1.4.0 when send a specific malformed 
IKE packet that will cause a denial of service .

------------------------------------------------------------------
II. Description

Using PROTOS Test-Suite 
c09-isakmp(https://www.ee.oulu.fi/research/ouspg/PROTOS_Test-Suite_c09-isakmp),when
 we run the following command "java -jar c09-isakmp-r1.jar --host 210.77.17.129 
--id 210.77.19.130 --secret dgggg --sourceport 34444  --index 3332" ,wireshark 
will capture the packet index 3332,then clike the field"Type 
Payload:Identification(5)",a error message will popup ,saying"Gtk-ERROR **:Byte 
index 6 is off the end of the line aborting...".Then wireshark be forced to 
close.


------------------------------------------------------------------
III. Impact

Denial of service 

------------------------------------------------------------------
IV. Affected

Wireshark 1.4.0, tested with Windows XP SP2. Previous versions may also be 
affected due to code reuse.

------------------------------------------------------------------
V. Solution

Update the software version to 1.5.0 or 1.6.0

------------------------------------------------------------------
VI. Credit

The penetration test team Of NCNIPC (China) is credited for this vulnerability.