Denial of Service Vulnerability in Wireshark: ITS Dissector Crash
Summary
DEBIAN-CVE-2024-9780: ITS dissector crash in Wireshark 4.4.0 allows denial of service via packet injection or crafted capture file. Affects wireshark versions < 4.4.1-1. Fixed in 4.4.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Wireshark is a widely-used network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It is essential for network troubleshooting, analysis, software and communications protocol development, and education. The vulnerability in question affects versions 4.4.0 and earlier, allowing for potential denial of service through packet injection or crafted capture files.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-9780 is a crash in the ITS dissector of Wireshark version 4.4.0. This flaw can be exploited by an attacker who sends specially crafted packets to the Wireshark application, leading to a denial of service condition. The issue arises from improper handling of certain packet types, which can cause the application to terminate unexpectedly, disrupting network analysis activities.
How To Fix
Minimum fixed version
4.4.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade wiresharkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid opening potentially malicious capture files or refrain from using Wireshark to analyze traffic from untrusted sources until the application is updated.
Conclusion
The vulnerability in Wireshark's ITS dissector poses a significant risk of denial of service through crafted packets. Users are strongly advised to update to version 4.4.1-1 or later to mitigate this risk. Additionally, employing safe practices while using the application can help prevent potential exploitation until the update is applied.
See every vulnerability recorded for wireshark →
FAQ
The vulnerability is a denial of service issue caused by a crash in the ITS dissector, which can be triggered by crafted packets.
Wireshark versions 4.4.0 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, avoid analyzing untrusted or suspicious capture files to mitigate the risk of exploitation.
More detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-9780.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for wireshark.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
