Infinite Loop Vulnerability in Wireshark Package - CVE-2017-6472
Summary
ALPINE-CVE-2017-6472: In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an RTMPT dissector infinite loop, triggered by packet injection or a malformed capture file. Affects wireshark versions < 2.2.5-r0. Fixed in 2.2.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is a widely-used network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It is known for its rich feature set, including deep inspection of hundreds of protocols, live capture and offline analysis, and a powerful display filter language. However, certain versions of Wireshark are vulnerable to a specific issue that can lead to an infinite loop, impacting its performance and reliability.
Vulnerability Detail
The vulnerability identified as CVE-2017-6472 affects Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10. It is caused by an infinite loop in the RTMPT dissector, which can be triggered by packet injection or a malformed capture file. This flaw can lead to denial of service, as the application may become unresponsive while processing the affected packets. The issue was addressed by properly incrementing a certain sequence value in the code, specifically in the file epan/dissectors/packet-rtmpt.c.
How To Fix
Minimum fixed version
2.2.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update Wireshark immediately, avoid opening untrusted or malformed capture files that may exploit this vulnerability. Additionally, refrain from using packet injection techniques that could trigger the infinite loop.
Conclusion
CVE-2017-6472 represents a significant vulnerability in certain versions of Wireshark, which can lead to an infinite loop and denial of service. It is crucial for users to update to the patched version to mitigate this risk. For those unable to update immediately, following the provided workarounds can help reduce exposure to this vulnerability.
See every vulnerability recorded for wireshark →
FAQ
CVE-2017-6472 is a vulnerability in Wireshark that can cause an infinite loop in the RTMPT dissector, potentially leading to denial of service.
The affected versions are Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-6472 is 7.5, indicating a high severity level.
If you cannot update, avoid using untrusted capture files and refrain from packet injection techniques that may exploit the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
