Critical DMP Dissector Crash Vulnerability in Wireshark
Summary
ALPINE-CVE-2017-15191: In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. Affects wireshark versions < 2.2.10-r0. Fixed in 2.2.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is a widely-used network protocol analyzer that enables users to capture and interactively browse the traffic running on a computer network. It is essential for network troubleshooting, analysis, software and communications protocol development, and education. However, certain versions of Wireshark are vulnerable to a crash due to improper validation in the DMP dissector, which can lead to denial of service.
Vulnerability Detail
In Wireshark versions 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, a vulnerability exists in the DMP dissector that allows for a crash when processing certain inputs. This issue arises from a lack of validation on string lengths, which can be exploited by attackers to cause the application to terminate unexpectedly. The ramifications of this vulnerability include potential denial of service, impacting users' ability to analyze network traffic effectively.
How To Fix
Minimum fixed version
2.2.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing DMP files until the package is updated. This will help mitigate the risk of encountering the crash while a permanent fix is being implemented.
Conclusion
The DMP dissector crash vulnerability in Wireshark poses a significant risk to users of affected versions. It is crucial to update to the patched version to ensure continued functionality and security. Utilizing tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for wireshark →
FAQ
Wireshark versions 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15 are affected.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary consequence is a denial of service, which can disrupt network analysis and troubleshooting activities.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
