Wireshark CVE-2017-9343 Denial of Service Vulnerability

Bugtraq ID:	98797
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-9343
Remote:	Yes
Local:	No
Published:	Jun 01 2017 12:00AM
Updated:	Jun 01 2017 12:00AM
Credit:	Peter Wu.
Vulnerable:	Wireshark Wireshark 2.2.6 Wireshark Wireshark 2.2.5 Wireshark Wireshark 2.2.4 Wireshark Wireshark 2.2.3 Wireshark Wireshark 2.2.2 Wireshark Wireshark 2.2.1 Wireshark Wireshark 2.2 Wireshark Wireshark 2.0.12 Wireshark Wireshark 2.0.11 Wireshark Wireshark 2.0.10 Wireshark Wireshark 2.0.9 Wireshark Wireshark 2.0.8 Wireshark Wireshark 2.0.7 Wireshark Wireshark 2.0.6 Wireshark Wireshark 2.0.5 Wireshark Wireshark 2.0.3 Wireshark Wireshark 2.0.2 Wireshark Wireshark 2.0.4 Wireshark Wireshark 2.0.1 Wireshark Wireshark 2.0.0 Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0
Not Vulnerable:	Wireshark Wireshark 2.2.7 Wireshark Wireshark 2.0.13

Wireshark CVE-2017-9343 Denial of Service Vulnerability

Wireshark is prone to a remote denial-of-service vulnerability because it fails to properly handle certain types of packets.

Attackers can exploit this issue to crash the affected application, resulting in denial-of-service conditions.

Wireshark 2.2.0 through 2.2.6 and 2.0.0 through 2.0.12 are vulnerable.

Wireshark CVE-2017-9343 Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Wireshark CVE-2017-9343 Denial of Service Vulnerability

References:

• Wireshark Homepage (Wireshark)
  
• Bug 13725 - [oss-fuzz] UBSAN: null pointer passed as argument 1, which is declar (Wireshark)
  
• Bug 1458144 - (CVE-2017-9343) CVE-2017-9343 wireshark: MSNIP dissector crash (wn (Redhat)
  
• CVE-2017-9343 (Redhat)
  
• msnip: Verify pinfo->dst is a valid IPv4 address (Wireshark)
  
• wnpa-sec-2017-30 · MSNIP dissector crash (Wireshark)