Executive brief
Wireshark, a widely used network protocol analyzer, is vulnerable to a denial-of-service attack. By sending a specially crafted network packet or providing a malicious capture file, an attacker can cause the software to enter an infinite loop. This results in the application becoming unresponsive and consuming excessive processor resources, potentially disrupting network monitoring and troubleshooting operations.
Technical details
An integer overflow vulnerability exists in the DHCPv6 dissector (epan/dissectors/packet-dhcpv6.c) of Wireshark. The flaw is triggered when the dissector processes a malformed DHCPv6 packet, either via live network injection or by loading a crafted PCAP file. This causes the dissection engine to enter a large or infinite loop, leading to 100% CPU utilization and application hang (Denial of Service). The issue was resolved by updating the data types used in the loop logic to prevent the overflow. Patches are available in versions 2.0.10 and 2.2.4.
Affected products
- Wireshark Wireshark 2.0.0 to 2.0.9, 2.2.0 to 2.2.3
Timeline
- 2017-01-23: advisory: Vendor advisory WNPA-SEC-2017-02 released
- 2017-01-25: disclosed: NVD publication date
- 2017-03-18: patched: Debian security update released
References
- http://www.debian.org/security/2017/dsa-3811
- http://www.securityfocus.com/bid/95798
- http://www.securitytracker.com/id/1037694
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13345
- https://code.wireshark.org/review/
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=57894f741f7cc98b46c9fdce7eee8256d2a4ae3f
- https://www.wireshark.org/security/wnpa-sec-2017-02.html