Wireshark NULL Pointer Dereference Vulnerability - CVE-2017-17997
Summary
ALPINE-CVE-2017-17997: In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. Affects wireshark versions < 2.2.12-r0. Fixed in 2.2.12-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is a widely-used network protocol analyzer that enables users to capture and interactively browse the traffic running on a computer network. It is essential for network troubleshooting, analysis, software and communications protocol development, and education. However, prior to version 2.2.12, Wireshark contained a vulnerability in the MRDISC dissector that could lead to application crashes due to improper handling of NULL pointers.
Vulnerability Detail
The vulnerability identified as CVE-2017-17997 arises from the MRDISC dissector in Wireshark, which misuses a NULL pointer, leading to a crash when processing certain packets. This issue is particularly concerning as it can disrupt network analysis activities and potentially expose systems to denial-of-service conditions. The vulnerability was addressed by validating IPv4 addresses in the code, ensuring that the dissector does not attempt to operate on invalid data.
How To Fix
Minimum fixed version
2.2.12-r0
This is the first release that contains the fix.
sudo apk add --upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability other than updating to the patched version. Users are advised to refrain from using the affected version until an update can be applied.
Conclusion
CVE-2017-17997 represents a significant vulnerability in Wireshark that can lead to application crashes due to improper handling of NULL pointers. Users are strongly encouraged to update to version 2.2.12 or later to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for wireshark →
FAQ
CVE-2017-17997 is a vulnerability in Wireshark that allows for a NULL pointer dereference in the MRDISC dissector, leading to application crashes.
Versions of Wireshark prior to 2.2.12 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2017-17997 is 7.5, indicating a high severity level.
If you cannot update immediately, it is recommended to limit the use of the affected version and monitor network traffic carefully until an update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
