Memory Consumption Vulnerability in Wireshark: CVE-2018-11357
Summary
ALPINE-CVE-2018-11357: In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. Affects wireshark versions < 2.2.15-r0. Fixed in 2.2.15-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is a widely-used network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It is known for its rich feature set, including deep inspection of hundreds of protocols, live capture and offline analysis, and a powerful display filter language. However, certain versions of Wireshark are vulnerable to a memory consumption issue that can lead to performance degradation and potential denial of service.
Vulnerability Detail
In Wireshark versions 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, a vulnerability exists in the LTP dissector and other dissectors that could lead to excessive memory consumption. This issue arises from the handling of negative lengths in the epan/tvbuff.c file, which, if exploited, could result in a denial of service by exhausting system memory resources. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.2.15-r0
This is the first release that contains the fix.
sudo apk add --upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected dissectors until they can update to a patched version. Additionally, monitoring system memory usage can help mitigate the impact of this vulnerability until a fix is applied.
Conclusion
In summary, CVE-2018-11357 is a significant vulnerability affecting specific versions of Wireshark, leading to excessive memory consumption. Users are advised to update to the patched version to mitigate the risk and ensure the stability of their applications.
See every vulnerability recorded for wireshark →
FAQ
CVE-2018-11357 is a vulnerability in Wireshark that allows for excessive memory consumption due to improper handling of negative lengths in certain dissectors.
The affected versions include Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14.
The vulnerability can lead to denial of service by exhausting system memory resources, potentially causing the application to crash or become unresponsive.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
