Infinite Loop Vulnerability in Wireshark Package Due to Malformed Capture Files
Summary
ALPINE-CVE-2017-6474: In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser infinite loop, triggered by a malformed capture file. Affects wireshark versions < 2.2.5-r0. Fixed in 2.2.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Wireshark is a widely-used network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It is essential for network troubleshooting, analysis, software and communications protocol development, and education. However, versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10 of Wireshark are vulnerable to an infinite loop caused by a malformed NetScaler file parser, which can lead to denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2017-6474, arises from an infinite loop in the NetScaler file parser within Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10. When a malformed capture file is processed, it triggers this infinite loop, potentially causing the application to hang or crash. This issue was addressed in the source code file wiretap/netscaler.c by implementing validation checks for record sizes, thereby preventing the infinite loop from occurring.
How To Fix
Minimum fixed version
2.2.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid opening any suspicious or untrusted NetScaler capture files until the package has been updated to the fixed version. Additionally, users can implement file validation checks before processing capture files to mitigate the risk of triggering the infinite loop.
Conclusion
In summary, CVE-2017-6474 represents a significant vulnerability in specific versions of Wireshark that can lead to denial of service through an infinite loop triggered by malformed capture files. Users are strongly advised to update to the latest version to mitigate this risk.
See every vulnerability recorded for wireshark →
FAQ
CVE-2017-6474 is a vulnerability in Wireshark that allows for an infinite loop when processing malformed NetScaler capture files, potentially leading to application crashes.
The affected versions are Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can update Wireshark by running the command 'apk update && apk upgrade wireshark' in your terminal.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
