Critical Out-of-Bounds Write Vulnerability in Wireshark Package
Summary
ALPINE-CVE-2017-13766: In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could crash with an out-of-bounds write. Affects wireshark versions < 2.2.9-r0. Fixed in 2.2.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is a widely-used network protocol analyzer that enables users to capture and interactively browse the traffic running on a computer network. It is essential for network troubleshooting, analysis, software and communications protocol development, and education. However, certain versions of Wireshark are vulnerable to an out-of-bounds write issue, particularly affecting the Profinet I/O dissector, which could lead to crashes and potential exploitation.
Vulnerability Detail
The vulnerability, identified as CVE-2017-13766, exists in Wireshark versions 2.4.0 and 2.2.0 to 2.2.8. It arises from insufficient validation of strings in the Profinet I/O dissector, which can lead to an out-of-bounds write. This flaw can cause the application to crash, and in some cases, it could be exploited to execute arbitrary code, posing a significant risk to users and systems relying on Wireshark for network analysis.
How To Fix
Minimum fixed version
2.2.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the Profinet I/O dissector until the package is updated. This can be done by disabling the dissector in the Wireshark settings or by not analyzing Profinet I/O traffic until the patch is applied.
Conclusion
The out-of-bounds write vulnerability in Wireshark poses significant risks to users and systems. It is crucial to update to the latest version to mitigate these risks. Users can also utilize tools like Vulert to monitor for vulnerabilities in their software without needing to access the code directly.
See every vulnerability recorded for wireshark →
FAQ
CVE-2017-13766 is a vulnerability in Wireshark that allows for an out-of-bounds write, potentially leading to application crashes or arbitrary code execution.
Wireshark versions 2.4.0 and 2.2.0 to 2.2.8 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If immediate updates are not possible, avoid using the Profinet I/O dissector as a temporary workaround until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
