CVE-2017-9351
HighSummary
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed by extracting the Vendor Class Identifier more carefully.
Risk Assessment
The ability to read beyond the buffer may lead to unexpected application behavior, posing a risk of potential data leakage or system crashes.
Recommendation
It is recommended to update Wireshark to the latest version to mitigate this vulnerability.
Other vulnerabilities in Wireshark
See all- CVE-2017-17997High
In Wireshark before version 2.2.12, the MRDISC dissector misuses a NULL pointer, causing the program to crash. This issue was addressed by validating an IPv4 address.
- CVE-2017-17935High
The File_read_line function in Wireshark up to version 2.2.11 does not properly strip ' ' characters, allowing remote attackers to cause application crashes via crafted packets that trigger the processing of an empty line.
- CVE-2017-17083High
In Wireshark versions 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash. This was addressed by ensuring that write operations are bounded by the beginning of a buffer.
- CVE-2017-13767High
In Wireshark versions 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop. This was addressed by adding length validation.
- CVE-2017-11410High
In Wireshark versions up to 2.0.13 and 2.2.x up to 2.2.7, the WBXML dissector could enter an infinite loop triggered by packet injection or a malformed capture file. This was addressed by adding validation of the relationships between indexes and lengths.
- CVE-2017-9766High
In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function.
- CVE-2017-9345High
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop. This was addressed by trying to detect self-referencing pointers.
- CVE-2017-9343High
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer. This was addressed by validating an IPv4 address.
- CVE-2017-7748High
In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP dissector could enter an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by adding a length check.
- CVE-2017-7747High
In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the PacketBB dissector could crash due to packet injection or a malformed capture file. This was addressed by restricting additions to the protocol tree.
Original NVD description (English source)
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-bootp.c by extracting the Vendor Class Identifier more carefully.