Denial of Service Vulnerability in Wireshark: Zigbee TLV Dissector Crash
Summary
DEBIAN-CVE-2024-0210: Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file. Affects wireshark versions < 4.2.2-1. Fixed in 4.2.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wireshark is a widely used network protocol analyzer that enables users to capture and interactively browse the traffic running on a computer network. It supports hundreds of protocols and is essential for network troubleshooting, analysis, and development. However, a vulnerability has been identified in the Zigbee TLV dissector, which can lead to a crash under certain conditions.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2024-0210, allows for a denial of service attack through packet injection or by using a crafted capture file. Specifically, the issue arises in Wireshark version 4.2.0, where the Zigbee TLV dissector can crash, potentially disrupting network analysis and monitoring activities. This vulnerability can be exploited by an attacker who sends specially crafted packets, leading to unexpected behavior in the application.
How To Fix
Minimum fixed version
4.2.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid opening untrusted capture files or packets that may exploit this vulnerability until the package is updated.
Conclusion
In summary, the Zigbee TLV dissector crash vulnerability in Wireshark poses a significant risk of denial of service. Users are strongly advised to update to the latest version to mitigate this risk and ensure the integrity of their network analysis activities.
See every vulnerability recorded for wireshark →
FAQ
The vulnerability allows for a denial of service attack through a crash in the Zigbee TLV dissector of Wireshark.
Wireshark versions prior to 4.2.2-1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
As a workaround, avoid opening untrusted capture files or packets that may exploit this vulnerability until you can update.
More information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-0210.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
