Infinite Loop Vulnerability in Wireshark Package: CVE-2017-7702
Summary
ALPINE-CVE-2017-7702: In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. Affects wireshark versions < 2.2.6-r0. Fixed in 2.2.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is a widely-used open-source network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It is known for its rich feature set, including deep inspection of hundreds of protocols, live capture and offline analysis, and a user-friendly graphical interface. However, versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11 of Wireshark are vulnerable to a specific issue in the WBXML dissector, which can lead to an infinite loop under certain conditions.
Vulnerability Detail
The vulnerability identified as CVE-2017-7702 affects the WBXML dissector in Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11. It can be triggered by packet injection or the use of a malformed capture file, causing the application to enter an infinite loop. This can lead to denial of service, as the application may become unresponsive, impacting users' ability to analyze network traffic effectively. The issue was addressed by adding length validation in the code responsible for processing WBXML packets.
How To Fix
Minimum fixed version
2.2.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the WBXML dissector for analyzing packets until the Wireshark package is updated. This can be done by filtering out WBXML packets from the capture or by using alternative tools for analysis.
Conclusion
CVE-2017-7702 represents a significant vulnerability in the Wireshark package, specifically affecting its WBXML dissector. Users are strongly encouraged to update to the latest version to mitigate the risk of denial of service. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for wireshark →
FAQ
CVE-2017-7702 is a vulnerability in Wireshark that allows for an infinite loop in the WBXML dissector, potentially leading to denial of service.
The affected versions are Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-7702 is 7.5, indicating a high severity level.
If immediate updates are not possible, avoid using the WBXML dissector and consider using alternative tools for packet analysis.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
