CVE-2019-16319 – This vulnerability in Wireshark allows an attac... (How to Fix)

📋 TL;DR

This vulnerability in Wireshark allows an attacker to cause a denial of service by triggering an infinite loop in the Gryphon protocol dissector. When processing specially crafted network packets, affected Wireshark versions could hang or crash, disrupting packet analysis. Users running Wireshark 2.6.0-2.6.10 or 3.0.0-3.0.3 are affected.

💻 Affected Systems

Products:

Wireshark

Versions: 2.6.0 to 2.6.10, 3.0.0 to 3.0.3

Operating Systems: All platforms running affected Wireshark versions

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in the Gryphon protocol dissector which is enabled by default; no special configuration required.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete denial of service where Wireshark becomes unresponsive, potentially causing packet capture loss and disrupting network analysis operations.

🟠

Likely Case

Wireshark process hangs or crashes when analyzing malicious Gryphon protocol packets, requiring manual restart and losing current capture data.

🟢

If Mitigated

Minimal impact with proper network segmentation and monitoring; Wireshark restarts automatically after crash.

🌐 Internet-Facing: LOW - Wireshark is typically not internet-facing; requires malicious packets to reach the monitoring interface.

🏢 Internal Only: MEDIUM - Internal attackers could disrupt network monitoring by sending crafted packets to monitored segments.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted Gryphon protocol packets to a network segment being monitored by vulnerable Wireshark.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Wireshark 2.6.11, 3.0.4, or later

Vendor Advisory: https://www.wireshark.org/security/wnpa-sec-2019-21.html

Restart Required: Yes

Instructions:

1. Download latest Wireshark from wireshark.org/download.html
2. Uninstall current version
3. Install patched version
4. Restart system or at least Wireshark processes

🔧 Temporary Workarounds

Disable Gryphon dissector

all

Prevent Wireshark from processing Gryphon protocol packets

Edit preferences -> Protocols -> Gryphon -> Uncheck 'Enable Gryphon protocol dissection'

Filter Gryphon traffic

all

Use capture filters to block Gryphon packets from being processed

Use capture filter: not gryphon

🧯 If You Can't Patch

Implement network segmentation to isolate Wireshark monitoring interfaces from untrusted traffic
Monitor Wireshark process health and implement automatic restart on crash detection

🔍 How to Verify

Check if Vulnerable:

Check Wireshark version: Help -> About Wireshark. If version is 2.6.0-2.6.10 or 3.0.0-3.0.3, you are vulnerable.

Check Version:

wireshark --version | grep 'Wireshark'

Verify Fix Applied:

Verify version is 2.6.11+, 3.0.4+, or later. Test with sample Gryphon packets to ensure no infinite loop occurs.

📡 Detection & Monitoring

Log Indicators:

Wireshark crash logs
Process monitoring showing Wireshark hanging with high CPU usage
System logs showing Wireshark process termination

Network Indicators:

Unusual Gryphon protocol packets on monitored segments
Repeated Gryphon packets from single source

SIEM Query:

ProcessName="wireshark" AND (EventID=1000 OR CPUUsage>90% FOR 60s)

📊 Metadata

CVE ID: CVE-2019-16319

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-835

Published: September 15, 2019

Last Updated: November 21, 2024

🔗 References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html Mailing List,Third Party Advisory
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16020 Issue Tracking,Vendor Advisory
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=02ddd49885c6a09e936a76aceb726ed06539704a
https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html Mailing List,Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2019-21.html Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html Mailing List,Third Party Advisory
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16020 Issue Tracking,Vendor Advisory
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=02ddd49885c6a09e936a76aceb726ed06539704a
https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html Mailing List,Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2019-21.html Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2019-16319, you might also want to check these: