CVE-2020-25862
📋 TL;DR
This vulnerability in Wireshark's TCP dissector allows remote attackers to cause a denial of service (crash) by sending specially crafted TCP packets with an invalid 0xFFFF checksum. It affects users running vulnerable versions of Wireshark to analyze network traffic. The crash occurs during packet dissection when processing malformed TCP segments.
💻 Affected Systems
- Wireshark
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Wireshark by Wireshark
Wireshark by Wireshark
Wireshark by Wireshark
⚠️ Risk & Real-World Impact
Worst Case
Wireshark crashes when analyzing malicious network traffic, disrupting network analysis and monitoring activities. In automated environments, this could cause monitoring systems to fail.
Likely Case
Wireshark crashes when encountering specially crafted TCP packets, requiring manual restart of the application. This disrupts network troubleshooting and analysis work.
If Mitigated
With proper segmentation and limited network exposure, the impact is minimal as Wireshark would only crash when analyzing malicious traffic from trusted sources.
🎯 Exploit Status
Exploitation requires sending specially crafted TCP packets that would be processed by Wireshark. No authentication is needed as this is triggered during packet analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Wireshark 3.2.7, 3.0.14, and 2.6.21
Vendor Advisory: https://gitlab.com/wireshark/wireshark/-/issues/16816
Restart Required: Yes
Instructions:
1. Download the patched version from wireshark.org. 2. Uninstall the vulnerable version. 3. Install the patched version. 4. Restart Wireshark and any related services.
🔧 Temporary Workarounds
Disable TCP dissection
allPrevents Wireshark from dissecting TCP packets, which avoids triggering the vulnerability but limits functionality
Edit preferences -> Protocols -> TCP -> Uncheck 'Allow subdissector to reassemble TCP streams'
Use capture filters
allFilter out potentially malicious TCP traffic before it reaches Wireshark
Use capture filters like 'not tcp' or limit to trusted sources
🧯 If You Can't Patch
- Restrict Wireshark to analyzing traffic from trusted networks only
- Run Wireshark in isolated environments with limited network exposure
🔍 How to Verify
Check if Vulnerable:
Check Wireshark version via Help -> About Wireshark. If version is between 2.6.0-2.6.20, 3.0.0-3.0.13, or 3.2.0-3.2.6, you are vulnerable.Check Version:
wireshark --version | grep 'Wireshark'Verify Fix Applied:
Verify version is 2.6.21+, 3.0.14+, or 3.2.7+. Test by capturing TCP traffic with invalid checksums to ensure no crash occurs.📡 Detection & Monitoring
Log Indicators:
- Wireshark crash logs, segmentation fault errors in system logs
Network Indicators:
- TCP packets with 0xFFFF checksum value in network captures
SIEM Query:
source="wireshark.log" AND ("segmentation fault" OR "crash" OR "SIGSEGV")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00038.html
- https://gitlab.com/wireshark/wireshark/-/commit/7f3fe6164a68b76d9988c4253b24d43f498f1753
- https://gitlab.com/wireshark/wireshark/-/issues/16816
- https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DQHPKZFQ7W3X34RYN3FWFYCFJD4FXJW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IGRYKW4XLR44YDWTAH547ODYYBYPB2D/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZUHMK5HYTUUDXA64T2TAMAFMYV674QBW/
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.wireshark.org/security/wnpa-sec-2020-12.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00038.html
- https://gitlab.com/wireshark/wireshark/-/commit/7f3fe6164a68b76d9988c4253b24d43f498f1753
- https://gitlab.com/wireshark/wireshark/-/issues/16816
- https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DQHPKZFQ7W3X34RYN3FWFYCFJD4FXJW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IGRYKW4XLR44YDWTAH547ODYYBYPB2D/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZUHMK5HYTUUDXA64T2TAMAFMYV674QBW/
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.wireshark.org/security/wnpa-sec-2020-12.html
