CVE-2019-10896
📋 TL;DR
CVE-2019-10896 is a denial-of-service vulnerability in Wireshark's DOF dissector that could cause the application to crash when processing specially crafted packets. This affects Wireshark users analyzing network traffic containing DOF protocol data. The vulnerability allows remote attackers to disrupt packet analysis operations.
💻 Affected Systems
- Wireshark
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Leap by Opensuse
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Wireshark by Wireshark
Wireshark by Wireshark
Wireshark by Wireshark
⚠️ Risk & Real-World Impact
Worst Case
Complete crash of Wireshark during packet analysis, potentially causing loss of ongoing network monitoring or forensic investigation data.
Likely Case
Application crash requiring restart, interrupting network analysis sessions and potentially causing data loss from unsaved captures.
If Mitigated
Minimal impact if Wireshark is not used to analyze DOF protocol traffic or if the vulnerable dissector is disabled.
🎯 Exploit Status
Exploitation requires the attacker to inject specially crafted DOF packets into network traffic being analyzed. The bug report includes crash details that could facilitate exploit development.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in Wireshark 2.4.14, 2.6.8, and 3.0.1
Vendor Advisory: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15617
Restart Required: Yes
Instructions:
1. Download latest patched version from wireshark.org. 2. Uninstall old version. 3. Install new version. 4. Restart system if prompted.
🔧 Temporary Workarounds
Disable DOF dissector
allPrevent Wireshark from parsing DOF protocol packets by disabling the dissector
In Wireshark: Analyze -> Enabled Protocols -> Uncheck 'DOF'
Use capture filters
allFilter out DOF traffic from being captured
Use capture filter: not port 65000 (common DOF port)
🧯 If You Can't Patch
- Disable the DOF dissector in Wireshark protocol settings
- Implement network segmentation to limit exposure to potentially malicious DOF traffic
🔍 How to Verify
Check if Vulnerable:
Check Wireshark version: Help -> About Wireshark. If version is 2.4.0-2.4.13, 2.6.0-2.6.7, or exactly 3.0.0, you are vulnerable.Check Version:
wireshark --version (Linux) or check About dialog (Windows)Verify Fix Applied:
Verify Wireshark version is 2.4.14+, 2.6.8+, or 3.0.1+. Test with sample DOF traffic to ensure no crashes.📡 Detection & Monitoring
Log Indicators:
- Wireshark crash logs
- Application error events in system logs
Network Indicators:
- Unusual DOF protocol traffic patterns
- Malformed DOF packets
SIEM Query:
EventID: 1000 OR EventID: 1001 AND ProcessName: wireshark.exe🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
- http://www.securityfocus.com/bid/107834
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15617
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=441b6d9071d6341e58dfe10719375489c5b8e3f0
- https://lists.debian.org/debian-lts-announce/2020/10/msg00036.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LYIOOQIMFQ3PA7AFBK4DNXHISTEYUC5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R/
- https://usn.ubuntu.com/3986-1/
- https://www.wireshark.org/security/wnpa-sec-2019-15.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
- http://www.securityfocus.com/bid/107834
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15617
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=441b6d9071d6341e58dfe10719375489c5b8e3f0
- https://lists.debian.org/debian-lts-announce/2020/10/msg00036.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LYIOOQIMFQ3PA7AFBK4DNXHISTEYUC5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R/
- https://usn.ubuntu.com/3986-1/
- https://www.wireshark.org/security/wnpa-sec-2019-15.html
