Is CVE-2017-5596 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-5596 being exploited in the wild.

How severe is CVE-2017-5596?

High severity, with a CVSS score of 7.5, published 25 January 2017.

Which products and versions are affected?

Wireshark 2.0.0 to 2.0.9, 2.2.0 to 2.2.3.

Is there a fix for CVE-2017-5596?

A patch was published on 2017-03-18: Debian released security update DSA-3811-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-5596 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2017-5596?

Check whether you run Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-5596: Wireshark ASTERIX dissector infinite loop denial of service

CVE-2017-5596 · Severity: high · CVSS 7.5 · Published 2017-01-25

Wireshark, a widely used network protocol analyzer, is vulnerable to a flaw that can cause the application to hang or become unresponsive. By sending a specially crafted network packet or tricking a user into opening a malicious capture file, an attacker can force the software into an infinite loop. This results in a denial-of-service, preventing security teams from monitoring network traffic and potentially impacting the stability of the system running the software.

Technologies: Wireshark. Vendors: Wireshark.

Quick answers

Is CVE-2017-5596 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-5596 being exploited in the wild.
How severe is CVE-2017-5596?: High severity, with a CVSS score of 7.5, published 25 January 2017.
Which products and versions are affected?: Wireshark 2.0.0 to 2.0.9, 2.2.0 to 2.2.3.
Is there a fix for CVE-2017-5596?: A patch was published on 2017-03-18: Debian released security update DSA-3811-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-5596 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2017-5596?: Check whether you run Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An infinite loop vulnerability exists in the ASTERIX dissector (packet-asterix.c) of Wireshark due to an integer overflow. When processing malformed packets or fuzzed PCAP files, a data type mismatch in the dissection engine prevents the loop exit condition from being met. This can be triggered remotely via packet injection or locally via a malformed capture file. The flaw allows an unauthenticated attacker to cause 100% CPU exhaustion and application unresponsiveness (Denial of Service). The issue was resolved by updating the data types used in the dissector to correctly handle large or unexpected values.

Affected products

Wireshark Wireshark 2.0.0 to 2.0.9, 2.2.0 to 2.2.3

Timeline

2017-01-23: advisory: Vendor advisory wnpa-sec-2017-01 published
2017-01-25: disclosed: CVE-2017-5596 published to NVD
2017-03-18: patched: Debian released security update DSA-3811-1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.