Infinite Loop Vulnerability in Wireshark Package (CVE-2017-9352)
Summary
ALPINE-CVE-2017-9352: In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bazaar dissector could go into an infinite loop. Affects wireshark versions < 2.2.7-r0. Fixed in 2.2.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is a widely-used network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It is known for its rich feature set, including deep inspection of hundreds of protocols, live capture and offline analysis, and a powerful display filter language. However, certain versions of Wireshark are vulnerable to a specific issue that can lead to an infinite loop, affecting its stability and performance.
Vulnerability Detail
The vulnerability identified as CVE-2017-9352 affects Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12. It originates from the Bazaar dissector, which is responsible for parsing Bazaar protocol packets. The flaw allows the dissector to enter an infinite loop during packet analysis, potentially leading to application crashes or unresponsiveness. This issue arises from improper handling of backward parsing within the dissector's code, specifically in the file epan/dissectors/packet-bzr.c.
How To Fix
Minimum fixed version
2.2.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the Bazaar dissector when analyzing packets, thereby preventing the infinite loop from occurring. This can be done by disabling the dissector in the Wireshark settings or by not capturing traffic that utilizes the Bazaar protocol.
Conclusion
CVE-2017-9352 presents a significant risk to users of specific Wireshark versions, leading to potential application instability. Updating to the patched version is crucial for maintaining the integrity and performance of the software. Users are encouraged to utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for wireshark →
FAQ
CVE-2017-9352 is a vulnerability in Wireshark that allows the Bazaar dissector to enter an infinite loop, causing the application to become unresponsive.
The affected versions are Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-9352 is 7.5, indicating a high severity level.
If an immediate update is not possible, consider disabling the Bazaar dissector as a temporary workaround to avoid the infinite loop issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
