FMP/NOTIFY Protocol Dissector DoS in Wireshark

Executive Summary

This vulnerability is a crash in the FMP/NOTIFY protocol dissector component of Wireshark versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16. It causes the application to crash when processing certain protocol data, leading to a denial of service condition.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is a denial of service (DoS) attack. An attacker could cause Wireshark to crash by sending specially crafted FMP/NOTIFY protocol data, disrupting network traffic analysis or monitoring activities.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for Wireshark or TShark instances that hang indefinitely or consume 100% CPU when processing certain FMP/NOTIFY protocol packets.

Specifically, crafted RPC packets with manipulated handle length values can trigger an infinite loop in the dissector, causing CPU exhaustion.

Detection can involve analyzing captured traffic for suspicious FMP/NOTIFY packets with unusual handle length values such as 0xFFFFFFF0 or 0xFFFFFFFC and very high numHandles values like 0x7FFFFFFF.

While no explicit commands are provided in the resources, you can use TShark or Wireshark to process pcap files and observe if the tool hangs or uses excessive CPU, indicating potential exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Wireshark to version 4.6.7, 4.4.17, or later, where this vulnerability has been fixed.

Avoid opening or processing untrusted or suspicious pcap files that may contain malformed FMP/NOTIFY packets.

If automated pipelines use TShark, ensure they are updated to the patched versions to prevent denial of service caused by crafted packets.

Useful 0 Not Useful 0