pcapng File Parser Crash in Wireshark Allows DoS

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a crash in the pcapng file parser component of Wireshark versions 4.6.0 to 4.6.6. It allows an attacker to cause a denial of service by triggering the crash.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is a denial of service condition. An attacker can cause Wireshark to crash, potentially disrupting network analysis or monitoring activities.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a crash in Wireshark when processing malformed pcapng files containing a DPIB UUID option longer than 16 bytes. Detection involves identifying such malformed or crafted pcapng files that could trigger the heap-buffer-overflow during file rewriting or exporting.

To detect potential exploitation or presence of this vulnerability, you can monitor for crashes or errors in Wireshark or related tools (such as editcap or tshark) when handling pcapng files.

While no specific detection commands are provided in the resources, you can use Wireshark or tshark to process pcapng files and watch for crashes or AddressSanitizer errors indicating heap-buffer-overflow.

Example commands to test or detect issues might include:

• Using tshark to read and rewrite a pcapng file: tshark -r input.pcapng -w output.pcapng
• Using editcap to rewrite a pcapng file: editcap input.pcapng output.pcapng

If these commands cause crashes or errors, it may indicate the presence of the vulnerability triggered by malformed DPIB UUID options.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Wireshark to version 4.6.7 or later, where the vulnerability has been fixed.

Until the upgrade is applied, avoid opening or processing untrusted or suspicious pcapng files that could be specially crafted to trigger the crash.

Additionally, be cautious with automated workflows that rewrite or export pcapng files using Wireshark tools like editcap or tshark, as these operations can trigger the heap-buffer-overflow.

Useful 0 Not Useful 0