Description
Multiple off-by-one errors in Wireshark (aka Ethereal) 0.9.7 to 0.99.0 have unknown impact and remote attack vectors via the (1) NCP NMAS and (2) NDPS dissectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wireshark | 0.99.2-1 | — |
| Debian 13 | wireshark | 0.99.2-1 | — |
| Debian 12 | wireshark | 0.99.2-1 | — |
| Debian 3.1 | ethereal | 0.10.10-2sarge6 | DSA-1127 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | wireshark +1 | 0.99.2-EL4.1 | RHSA-2006:0602 |
| RHEL 3 | wireshark +1 | 0.99.2-EL3.1 | RHSA-2006:0602 |
Advisories 2
- RHSA-2006:0602 Red Hat Security Advisory: wireshark security update (was ethereal) Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1127 ethereal - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2006:0602 vendor-advisory
- oval:org.mitre.oval:def:11350 vdb-entry signature
- SUSE-SR:2006:020 vendor-advisory
- 21121 third-party-advisory
- 1016532 vdb-entry
- 21078 third-party-advisory
- 27368 vdb-entry
- GLSA-200607-09 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-197.htm
- 21598 third-party-advisory
- 21467 third-party-advisory
- 22089 third-party-advisory
- 21204 third-party-advisory
- 20060719 rPSA-2006-0132-1 tshark wireshark mailing-list
- wireshark-nmas-ndps-offbyone(27827) vdb-entry
- 27367 vdb-entry
- 27366 vdb-entry
- ADV-2006-2850 vdb-entry
- http://www.wireshark.org/security/wnpa-sec-2006-01.html
- DSA-1127 vendor-advisory
- 21107 third-party-advisory
- 21249 third-party-advisory
- MDKSA-2006:128 vendor-advisory
- 21488 third-party-advisory
- https://issues.rpath.com/browse/RPL-512
- 19051 vdb-entry