Catapult DCT2000 Protocol Dissector DoS in Wireshark

Executive Summary

This vulnerability is a crash in the Catapult DCT2000 protocol dissector component of Wireshark versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16. It allows an attacker to cause a denial of service by triggering the crash.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is a denial of service condition. An attacker can cause Wireshark to crash, potentially disrupting network analysis or monitoring activities.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a crash in Wireshark's Catapult DCT2000 protocol dissector caused by malformed packets or malicious packet trace files.

Detection can be done by monitoring for crashes or segmentation faults in Wireshark when opening Catapult DCT2000 capture files or analyzing network traffic containing this protocol.

Using sanitizers like AddressSanitizer (ASAN) or UndefinedBehaviorSanitizer (UBSAN) during testing can help detect out-of-bounds writes and memory corruption caused by malformed packets.

No specific network commands are provided in the resources, but you can check for suspicious or malformed Catapult DCT2000 packets in your captures by filtering with Wireshark display filters related to the Catapult DCT2000 protocol.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Wireshark to version 4.6.7, 4.4.17, or later, where the vulnerability has been fixed by adding bounds checking to prevent the crash.

Avoid opening untrusted or suspicious Catapult DCT2000 capture files that could contain malformed packets designed to trigger the vulnerability.

Useful 0 Not Useful 0