Critical AMQP Dissector Crash Vulnerability in Wireshark
Summary
ALPINE-CVE-2017-11408: In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. Affects wireshark versions < 2.2.8-r0. Fixed in 2.2.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is a widely-used network protocol analyzer that enables users to capture and interactively browse the traffic running on a computer network. It is essential for network troubleshooting, analysis, software and communications protocol development, and education. However, versions 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13 of Wireshark contain a vulnerability in the AMQP dissector that could lead to application crashes, impacting network analysis capabilities.
Vulnerability Detail
The vulnerability, identified as CVE-2017-11408, arises from a flaw in the AMQP dissector within Wireshark. Specifically, the dissector fails to properly check for successful list dissection, which can lead to a crash when processing certain AMQP packets. This issue poses a significant risk as it can disrupt network monitoring and analysis, potentially leading to data loss or downtime. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.2.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing AMQP packets until the update is applied. This can help mitigate the risk of crashes while maintaining network analysis capabilities for other protocols.
Conclusion
The AMQP dissector vulnerability in Wireshark poses a significant risk to users, potentially leading to application crashes and disruption of network analysis. It is crucial to update to the patched version to mitigate this risk. Users can also utilize tools like Vulert to monitor for such vulnerabilities in their software.
See every vulnerability recorded for wireshark →
FAQ
CVE-2017-11408 is a vulnerability in Wireshark's AMQP dissector that can cause the application to crash when processing certain packets.
You can check your version of Wireshark by navigating to the 'Help' menu and selecting 'About Wireshark'. If your version is between 2.2.0 and 2.2.7 or 2.0.0 and 2.0.13, it is affected.
Yes, tools like Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, refrain from using the AMQP dissector to avoid crashes until you can apply the patch.
Detailed information about CVE-2017-11408 can be found in the official CVE database or through security advisories related to Wireshark.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
