Buffer Overflow Vulnerability in Wireshark 2.2.0 to 2.2.6
Summary
ALPINE-CVE-2017-9348: In Wireshark 2.2.0 to 2.2.6, the DOF dissector could read past the end of a buffer. Affects wireshark versions < 2.2.7-r0. Fixed in 2.2.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is a widely-used network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It is essential for network troubleshooting, analysis, software and communications protocol development, and education. The vulnerability in question affects versions 2.2.0 to 2.2.6 of Wireshark, where improper validation in the DOF dissector could lead to a buffer overflow, potentially allowing an attacker to execute arbitrary code.
Vulnerability Detail
The vulnerability identified as CVE-2017-9348 arises from the DOF dissector's failure to properly validate size values, which can lead to reading past the end of a buffer. This flaw can be exploited by attackers to manipulate the application’s memory, potentially leading to arbitrary code execution. The severity of this vulnerability is rated with a CVSS score of 7.5, indicating a high risk level.
How To Fix
Minimum fixed version
2.2.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected versions of Wireshark until they can update to the patched version. Additionally, limiting access to the application can reduce the risk of exploitation.
Conclusion
In summary, CVE-2017-9348 is a significant vulnerability in Wireshark versions 2.2.0 to 2.2.6 that can lead to buffer overflow and potential arbitrary code execution. Users are advised to update to version 2.2.7-r0 or later to mitigate this risk.
See every vulnerability recorded for wireshark →
FAQ
CVE-2017-9348 is a vulnerability in Wireshark that allows for a buffer overflow due to improper validation in the DOF dissector.
You can check your version of Wireshark by running 'wireshark -v' in the terminal. If it is between 2.2.0 and 2.2.6, it is affected.
Not fixing this vulnerability could allow attackers to execute arbitrary code, potentially compromising the system and data.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software using just a manifest file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
