vendor:
Wireshark
by:
ipv
7.5
CVSS
HIGH
Remote stack-based buffer overflow
119
CWE
Product Name: Wireshark
Affected Version From: Wireshark <= 1.4.4
Affected Version To: Wireshark <= 1.4.4
Patch Exists: NO
Related CWE: CVE-2011-1591
CPE: a:wireshark:wireshark:1.4.4
Platforms Tested: Archlinux
2011
CVE-2011-1591 : Wireshark <= 1.4.4 packet-dect.c dissect_dect()
This code exploits a remote stack-based buffer overflow in the DECT dissector of wireshark. ROP chains aim to recover dynamically stack address, mprotect it and stack pivot to shellcode located in the payload. The process is automated and bypasses any NX/ALSR.
Mitigation:
Update to a version of Wireshark greater than 1.4.4