Wireshark 'epan/dissectors/packet-dns.c' Denial of Service Vulnerability

Bugtraq ID:	98798
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-9345
Remote:	Yes
Local:	No
Published:	Jun 01 2017 12:00AM
Updated:	Jun 01 2017 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Wireshark Wireshark 2.2.6 Wireshark Wireshark 2.2.5 Wireshark Wireshark 2.2.4 Wireshark Wireshark 2.2.3 Wireshark Wireshark 2.2.2 Wireshark Wireshark 2.2.1 Wireshark Wireshark 2.2 Wireshark Wireshark 2.0.12 Wireshark Wireshark 2.0.11 Wireshark Wireshark 2.0.10 Wireshark Wireshark 2.0.9 Wireshark Wireshark 2.0.8 Wireshark Wireshark 2.0.7 Wireshark Wireshark 2.0.6 Wireshark Wireshark 2.0.5 Wireshark Wireshark 2.0.3 Wireshark Wireshark 2.0.2 Wireshark Wireshark 2.0.4 Wireshark Wireshark 2.0.1 Wireshark Wireshark 2.0.0 Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0
Not Vulnerable:	Wireshark Wireshark 2.2.7 Wireshark Wireshark 2.0.13

Wireshark 'epan/dissectors/packet-dns.c' Denial of Service Vulnerability

Wireshark is prone to a remote denial-of-service vulnerability because it fails to properly handle certain types of packets.

Attackers can exploit this issue to crash the affected application, resulting in denial-of-service conditions.

Wireshark 2.2.0 through 2.2.6 and 2.0.0 through 2.0.12 are vulnerable.

Wireshark 'epan/dissectors/packet-dns.c' Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Wireshark 'epan/dissectors/packet-dns.c' Denial of Service Vulnerability

References:

• Bug 13633 - [oss-fuzz] timeout: expand_dns_name epan/dissectors/packet-dns.c:115 (Wireshark)
  
• Bug 1458140 - (CVE-2017-9345) CVE-2017-9345 wireshark: DNS dissector infinite lo (Red Hat Bugzilla)
  
• CVE-2017-9345 (Red Hat Bugzilla)
  
• Wireshark Homepage (Wireshark)
  
• wnpa-sec-2017-26 (Wireshark)