CSN.1 Protocol Dissector DoS in Wireshark

Executive Summary

This vulnerability is a crash in Wireshark's CSN.1 protocol dissector affecting versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18. It occurs due to improper handling of malformed packets, which can cause Wireshark to crash when processing malicious network traffic or opening a crafted packet trace file.

Useful 0 Not Useful 0

Detection Guidance

Monitor Wireshark instances for crashes when processing CSN.1 protocol packets. Check for malformed packets on UDP port 4729 (GSMTAP default port) using network monitoring tools like tcpdump or Wireshark itself. Look for heap corruption indicators in logs if ASan or similar tools are enabled.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to crash Wireshark by sending a malformed packet or tricking a user into opening a malicious file. This results in a denial of service, preventing normal use of the application. The vulnerability may also allow heap buffer overflow, potentially leading to further system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service by crashing Wireshark through malformed packets or malicious files. It does not directly impact data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. However, if Wireshark is used in environments subject to these regulations, a crash could disrupt monitoring or forensic analysis, potentially affecting compliance with audit logging requirements under GDPR or HIPAA's security rule.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wireshark to version 4.6.9 or 4.4.19 or later immediately. Disable the GSM RLC/MAC dissector if not required by removing it from Wireshark's configuration. Block or monitor UDP traffic on port 4729 at the network perimeter to prevent crafted packets from reaching vulnerable systems.

Useful 0 Not Useful 0