Wireshark LDSS Dissector Crash Vulnerability - CVE-2017-6469
Summary
ALPINE-CVE-2017-6469: In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. Affects wireshark versions < 2.2.5-r0. Fixed in 2.2.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is a widely-used open-source network protocol analyzer that enables users to capture and interactively browse the traffic on a computer network. It is known for its rich feature set, including deep inspection of hundreds of protocols, live capture and offline analysis, and a powerful GUI. However, certain versions of Wireshark are vulnerable to a crash caused by malformed packets, specifically affecting the LDSS dissector.
Vulnerability Detail
The vulnerability, identified as CVE-2017-6469, exists in Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10. It is triggered by packet injection or the use of a malformed capture file, leading to a crash of the LDSS dissector. This issue arises from improper memory allocation for a specific data structure, which can result in denial of service (DoS) when exploited. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.2.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, avoid opening untrusted or malformed capture files that could exploit this vulnerability until you can update to the patched version.
Conclusion
CVE-2017-6469 is a significant vulnerability in Wireshark that can lead to application crashes when handling malformed packets. It is crucial for users to update to the patched version to mitigate the risk of denial of service. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for wireshark →
FAQ
CVE-2017-6469 is a vulnerability in Wireshark that can cause a crash when processing malformed packets.
Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to a denial of service (DoS), causing the application to crash and potentially disrupt network analysis activities.
Yes, a patch is available in version 2.2.5-r0 of Wireshark, which resolves the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
