Pcapng Parser Crash Causes Denial of Service in Wireshark

Executive Summary

This vulnerability is a denial of service issue in the pcapng file parser affecting versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. It causes the parser to crash when processing certain pcapng files, leading to service disruption.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to a pcapng file parser crash in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18, leading to denial of service. Detection involves checking the installed version of the affected software. Use commands like 'dpkg -l | grep <package-name>' on Debian-based systems or 'rpm -qa | grep <package-name>' on RPM-based systems to verify the version.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to cause a denial of service by crashing the pcapng file parser. This could disrupt network monitoring, analysis, or security tools that rely on parsing pcapng files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service through a pcapng file parser crash, which may disrupt system availability. While not directly tied to data confidentiality or integrity, prolonged downtime could impact compliance with standards requiring system availability, such as HIPAA for healthcare systems or GDPR for service continuity. However, specific compliance impacts depend on system context and mitigations.

Useful 0 Not Useful 0

Mitigation Strategies

Update Wireshark to versions 4.6.8 or later for the 4.6.x branch, or 4.4.19 or later for the 4.4.x branch to patch the pcapng file parser crash vulnerability.

Useful 0 Not Useful 0