Executive brief
Wireshark, a widely used network protocol analyzer, is vulnerable to a flaw that can cause the application to hang or become unresponsive. By sending a specially crafted network packet or tricking a user into opening a malicious capture file, an attacker can force the software into an infinite loop. This results in a denial-of-service, preventing security teams from monitoring network traffic and potentially impacting the stability of the system running the software.
Technical details
An infinite loop vulnerability exists in the ASTERIX dissector (packet-asterix.c) of Wireshark due to an integer overflow. When processing malformed packets or fuzzed PCAP files, a data type mismatch in the dissection engine prevents the loop exit condition from being met. This can be triggered remotely via packet injection or locally via a malformed capture file. The flaw allows an unauthenticated attacker to cause 100% CPU exhaustion and application unresponsiveness (Denial of Service). The issue was resolved by updating the data types used in the dissector to correctly handle large or unexpected values.
Affected products
- Wireshark Wireshark 2.0.0 to 2.0.9, 2.2.0 to 2.2.3
Timeline
- 2017-01-23: advisory: Vendor advisory wnpa-sec-2017-01 published
- 2017-01-25: disclosed: CVE-2017-5596 published to NVD
- 2017-03-18: patched: Debian released security update DSA-3811-1
References
- http://www.debian.org/security/2017/dsa-3811
- http://www.securityfocus.com/bid/95795
- http://www.securitytracker.com/id/1037694
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13344
- https://code.wireshark.org/review/
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=781f03580c81339513bb1238b202b72469a1240b
- https://www.wireshark.org/security/wnpa-sec-2017-01.html