Описание
SANE protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
A flaw was found in Wireshark. The SANE (Scanner Access Now Easy) protocol dissector contains an infinite loop vulnerability. A local user processing specially crafted SANE protocol traffic, such as opening a malicious capture file, can trigger this flaw, leading to a denial of service (DoS) in Wireshark.
Меры по смягчению последствий
To mitigate this issue, users should avoid opening untrusted capture files or processing SANE protocol traffic from untrusted sources. If Wireshark is not actively used, consider removing the wireshark package to eliminate the attack surface. For Red Hat Enterprise Linux and Fedora, this can be done using sudo dnf remove wireshark. Warning: Removing Wireshark may impact network analysis capabilities.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | wireshark | Fix deferred | ||
| Red Hat Enterprise Linux 6 | wireshark | Fix deferred | ||
| Red Hat Enterprise Linux 7 | wireshark | Fix deferred | ||
| Red Hat Enterprise Linux 8 | wireshark | Fix deferred | ||
| Red Hat Enterprise Linux 9 | wireshark | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5 Medium
CVSS3
Связанные уязвимости
SANE protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
SANE protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
SANE protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and ...
SANE protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Уязвимость функции dissect_control_option_value() диссектора протокола SANE анализатора трафика компьютерных сетей Wireshark, позволяющая нарушителю вызывать отказ в обслуживании
5 Medium
CVSS3