Wireshark DMP Dissector CVE-2017-15191 Denial of Service Vulnerability

Bugtraq ID:	101227
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-15191
Remote:	Yes
Local:	No
Published:	Oct 10 2017 12:00AM
Updated:	Oct 10 2017 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Wireshark Wireshark 2.4.1 Wireshark Wireshark 2.4 Wireshark Wireshark 2.2.9 Wireshark Wireshark 2.2.8 Wireshark Wireshark 2.2.7 Wireshark Wireshark 2.2.6 Wireshark Wireshark 2.2.5 Wireshark Wireshark 2.2.4 Wireshark Wireshark 2.2.3 Wireshark Wireshark 2.2.2 Wireshark Wireshark 2.2.1 Wireshark Wireshark 2.2 Wireshark Wireshark 2.0.15 Wireshark Wireshark 2.0.14 Wireshark Wireshark 2.0.13 Wireshark Wireshark 2.0.12 Wireshark Wireshark 2.0.11 Wireshark Wireshark 2.0.10 Wireshark Wireshark 2.0.9 Wireshark Wireshark 2.0.8 Wireshark Wireshark 2.0.7 Wireshark Wireshark 2.0.6 Wireshark Wireshark 2.0.5 Wireshark Wireshark 2.0.3 Wireshark Wireshark 2.0.2 Wireshark Wireshark 2.0.4 Wireshark Wireshark 2.0.1 Wireshark Wireshark 2.0.0
Not Vulnerable:	Wireshark Wireshark 2.2.10 Wireshark Wireshark 2.0.16 Wireshark Wireshark 2.4.2

Wireshark DMP Dissector CVE-2017-15191 Denial of Service Vulnerability

A sample packet trace file is available in the Wireshark bug report. Please see the references for more information.

Wireshark DMP Dissector CVE-2017-15191 Denial of Service Vulnerability

References:

• DMP: check 7bit string length before decoding it (Wireshark)
  
• DMP: check 7bit string length before decoding it (Wireshark)
  
• Wireshark Homepage (Wireshark)
  
• Bug 14068 - [oss-fuzz] UBSAN: null pointer passed as argument 1, which is decla (Wireshark)
  
• wnpa-sec-2017-44 · DMP dissector crash (Wireshark)