Software Update: Wireshark 1.12.5

Version 1.12.5 of the open source protocol analyzer and packet niffer Wireshark has been released. With this program, various data packets and network protocols on the network can be analyzed. Also, the program can use previously saved data traffic as input. Wireshark runs on Windows, Linux, and OS X, with separate downloads for 32bit and 64bit versions of the operating systems. In version 1.12, support for Windows XP and the U3 has been dropped, and it has been announced that this will soon also happen for the 32-bit version of OS X. We are also working hard on the transition from GTK+ to Qt, which should be complete in version 2.0. The following improvements have also been made in this release:

The following vulnerabilities have been fixed:

• wnpa-sec-2015-12 The LBMR dissector could go into an infinite loop. †Bug 11036† CVE-2015-3808 CVE-2015-3809
• wnpa-sec-2015-13 The WebSocket dissector could recurse excessively. †Bug 10989† CVE-2015-3810
• wnpa-sec-2015-14 The WCP dissector could crash while decompressing data. †Bug 10978† CVE-2015-3811
• wnpa-sec-2015-15 The X11 dissector could leak memory. †Bug 11088† CVE-2015-3812
• wnpa-sec-2015-16 The packet reassembly code could leak memory. †Bug 11129† CVE-2015-3813
• wnpa-sec-2015-17 The IEEE 802.11 dissector could go into an infinite loop. †Bug 11110† CVE-2015-3814
• wnpa-sec-2015-18 The Android Logcat file parser could crash. Discovered by Hanno Böck. †Bug 11188† CVE-2015-3815

The following bugs have been fixed:

• Wireshark crashes if “Update list of packets in real time” is disabled and a display filter is applied while capturing. †Bug 6217†
• EAPOL 4-way handshake information wrong. †Bug 10557†
• RPC NULL calls incorrectly flagged as malformed. †Bug 10646†
• Wireshark relative ISN set incorrectly if raw ISN set to 0. (Bug 10713†
• Buffer overrun in encryption code. †Bug 10849†
• Crash when use Telephony / Voip calls. †Bug 10885†
• ICMP Parameter Problem message contains Length of original datagram is treated as the total IPv4 length. †Bug 10991†
• ICMP Redirect takes 4 bytes for IPv4 payload instead of 8. (Bug 10992†
• Missing field “tcp.pdu.size” in TCP stack. †Bug 11007†
• Sierra EM7345 marks MBIM packets as NCM. †Bug 11018†
• Possible infinite loop DoS in ForCES dissector. †Bug 11037†
• “Decode As…” crashes when a packet dialog is open. †Bug 11043†
• Interface Identifier incorrectly represented by Wireshark. †Bug 11053†
• “Follow UDP Stream” on mpeg packets crashes wireshark v.1.12.4 (works fine on v.1.10.13). †Bug 11055†
• Annoying popup when trying to capture on bonds. †Bug 11058†
• Request-response cross-reference in USB URB packets incorrect. †Bug 11072†
• Right clicking in Expert Infos to create a filter (duplicate IP) results in invalid filters. †Bug 11073†
• CanOpen dissector fails on frames with RTR and 0 length. †Bug 11083†
• Typo in secp521r1 curve wrongly identified as sect521r1. †Bug 11106†
• packet-zbee-zcl.h: IS_ANALOG_SUBTYPE doesn’t filter ENUM. †Bug 11120†
• Typo: “LTE Positioning Protocol” abbreviated as “LPP”
• not “LLP”. †Bug 11141†
• Missing Makefile.nmake in ansi1/Kerberos directory. †Bug 11155†
• Can’t build tshark without the Qt packages installed unless –without-qt is specified. †Bug 11157†

Updated Protocol Support

• AllJoyn
• ASN.1 PER
• ATM
• CANopen
• Diameter
• forCES
• GSM RLC/MAC
• GSMTAP
• ICMP
• IEC-60870-5-104
• IEEE 802.11
• IMF
• IP
• LBMC
• LBMR
• LDAP
• LPP
• MBIM
• MEGACO
• MP2T
• PKCS-1
• PPP IPv6CP
• RPC
• SPNEGO
• SRVLOC
• SSL
• T.38
• TCP
• USB
• WCP
• WebSocket
• X11
• and ZigBee ZCL

New and Updated Capture File Support

• Android Logcat
• Savvius OmniPeek
• Visual Networks

The following downloads are available:
Wireshark 1.12.5 for Windows (32bit)
Wireshark 1.12.5 for Windows (64bit)
Wireshark 1.12.5 for PortableApps
Wireshark 1.12.5 for OS X 10.5 (32bit)
Wireshark 1.12.5 for OS X 10.6 and above (64bit)
Wireshark 1.12.5 source code for Linux, Solaris and *BSD among others