OpenSAFETY Dissector Crash in Wireshark
Summary
CVE-2017-9350: In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. Affects wireshark across 3 version ranges.
< 2.2.7-r0
>= 9a73b827b22c7ce9132e939b9f07ec4425fc2aa6, <= 2a06057a0ff32623003567f4acf556c759bf751d
>= 5368c50be46d4a44986d12bdfc0a35b42c0f34fc, <= 32dac6a1ea518cb0062c139e2b3df298afc93c30
Fixed in 2.2.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is an open-source network protocol analyzer used for troubleshooting, analysis, development, and education. It allows users to capture and interactively browse network traffic. The openSAFETY dissector in Wireshark is responsible for decoding and analyzing openSAFETY protocol packets. OpenSAFETY is a safety communication protocol used in industrial automation systems. This vulnerability affects versions 2.0.0 to 2.0.12 and 2.2.0 to 2.2.6 of Wireshark.
Vulnerability Detail
The openSAFETY dissector in Wireshark is susceptible to a crash or memory exhaustion vulnerability. An attacker can exploit this vulnerability by sending a specially crafted openSAFETY packet, causing the dissector to crash or consume excessive system memory. The vulnerability can lead to a denial of service (DoS) condition, disrupting the normal operation of Wireshark and potentially affecting the availability of the system being analyzed.
How To Fix
Minimum fixed version
2.2.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of Wireshark as soon as possible.
Conclusion
The openSAFETY dissector vulnerability in Wireshark can lead to a denial of service (DoS) condition. To mitigate this risk, it is crucial to update Wireshark to version 2.2.7 or later. By applying the fix, users can ensure the stability and availability of Wireshark during network analysis. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wireshark →
FAQ
The vulnerability can lead to a denial of service (DoS) condition, causing Wireshark to crash or consume excessive system memory. This can disrupt the normal operation of Wireshark and potentially affect the availability of the system being analyzed.
You can use the Vulert Playground at Vulert Scanner to check if your version of Wireshark is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will provide real-time alerts for open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits targeting this vulnerability. However, it is important to apply the recommended update to mitigate the risk.
Yes, this vulnerability can be exploited remotely by sending specially crafted openSAFETY packets to a vulnerable Wireshark instance.
Yes, the vulnerability can be fixed by updating Wireshark to version 2.2.7 or later. The fix involves checking for a negative length in the packet-opensafety.c file.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
