CVE-2019-19553
📋 TL;DR
This vulnerability in Wireshark allows attackers to cause a denial of service (crash) by sending specially crafted CMS (Cryptographic Message Syntax) packets. It affects Wireshark users analyzing network traffic containing malicious CMS content. The crash occurs during packet dissection when the CMS dissector fails to properly handle object identifiers.
💻 Affected Systems
- Wireshark
📦 What is this software?
Leap by Opensuse
Solaris by Oracle
Wireshark by Wireshark
Wireshark by Wireshark
⚠️ Risk & Real-World Impact
Worst Case
Complete Wireshark crash leading to loss of ongoing packet capture analysis and potential data loss if unsaved.
Likely Case
Wireshark application crash when analyzing malicious network traffic, disrupting network analysis activities.
If Mitigated
No impact if Wireshark is not used to analyze CMS traffic or if patched version is deployed.
🎯 Exploit Status
Exploitation requires sending malicious CMS packets to network being analyzed. Proof of concept available in bug reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Wireshark 3.0.7 and 2.6.13
Vendor Advisory: https://www.wireshark.org/security/wnpa-sec-2019-23.html
Restart Required: Yes
Instructions:
1. Download latest Wireshark version from wireshark.org. 2. Uninstall current version. 3. Install patched version. 4. Restart system.
🔧 Temporary Workarounds
Disable CMS dissector
allPrevent Wireshark from dissecting CMS packets by disabling the CMS protocol dissector
wireshark -o cms.desegment:false
tshark -o cms.desegment:false
Filter CMS traffic
allUse capture filters to exclude CMS traffic from analysis
not port 989 or 990
not tcp port 989 or 990
🧯 If You Can't Patch
- Restrict Wireshark use to trusted network segments only
- Implement network monitoring to detect and block malicious CMS traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check Wireshark version: if between 2.6.0-2.6.12 or 3.0.0-3.0.6, system is vulnerableCheck Version:
wireshark -v | grep "Wireshark" or tshark -v | grep "TShark"Verify Fix Applied:
Verify Wireshark version is 2.6.13+ or 3.0.7+ and test with known malicious CMS packet samples📡 Detection & Monitoring
Log Indicators:
- Wireshark crash logs
- Application error reports mentioning CMS dissector
- Segmentation fault errors in system logs
Network Indicators:
- Malformed CMS packets in network traffic
- Unusual CMS protocol traffic patterns
SIEM Query:
source="wireshark.log" AND ("crash" OR "segmentation fault" OR "CMS")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15961
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=34d2e0d5318d0a7e9889498c721639e5cbf4ce45
- https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.wireshark.org/security/wnpa-sec-2019-22.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15961
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=34d2e0d5318d0a7e9889498c721639e5cbf4ce45
- https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.wireshark.org/security/wnpa-sec-2019-22.html
