CVE-2023-6175
📋 TL;DR
A buffer overflow vulnerability in Wireshark's NetScreen file parser allows attackers to cause a denial of service by providing a specially crafted capture file. This affects Wireshark versions 4.0.0-4.0.10 and 3.6.0-3.6.18. Users who open malicious packet capture files with vulnerable Wireshark versions are at risk.
💻 Affected Systems
- Wireshark
📦 What is this software?
Wireshark by Wireshark
Wireshark by Wireshark
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash leading to denial of service, potentially disrupting network analysis workflows and causing data loss of unsaved captures.
Likely Case
Wireshark crashes when opening malicious capture files, requiring restart and losing any unsaved work.
If Mitigated
Minimal impact if Wireshark is not used to analyze untrusted capture files or if patched versions are deployed.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious capture file. The vulnerability is well-documented with public references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Wireshark 4.0.11 or 3.6.19
Vendor Advisory: https://www.wireshark.org/security/wnpa-sec-2023-29.html
Restart Required: Yes
Instructions:
1. Download latest Wireshark from wireshark.org. 2. Run installer. 3. Restart Wireshark after installation. For package managers: sudo apt update && sudo apt upgrade wireshark (Debian/Ubuntu) or sudo yum update wireshark (RHEL/CentOS).
🔧 Temporary Workarounds
Disable NetScreen file parser
allTemporarily disable the vulnerable parser to prevent exploitation
Edit preferences -> Protocols -> NetScreen -> Uncheck 'Enable NetScreen file dissection'
Use tshark with dissector exclusion
allRun tshark with dissector exclusion for NetScreen files
tshark -X lua_script:disable_dissector.lua -r capture.pcap
🧯 If You Can't Patch
- Restrict Wireshark usage to trusted users only
- Implement application whitelisting to prevent execution of malicious capture files
- Educate users not to open capture files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Wireshark version: Help -> About Wireshark. If version is between 4.0.0-4.0.10 or 3.6.0-3.6.18, you are vulnerable.Check Version:
wireshark --version | head -1Verify Fix Applied:
Verify version is 4.0.11+ or 3.6.19+ in Help -> About Wireshark. Test opening known safe NetScreen capture files.📡 Detection & Monitoring
Log Indicators:
- Wireshark crash logs in system logs
- Application error events mentioning Wireshark
Network Indicators:
- Unusual capture file transfers to Wireshark users
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="wireshark.exe" OR "Wireshark" IN Application🔗 References
- https://gitlab.com/wireshark/wireshark/-/issues/19404
- https://www.wireshark.org/security/wnpa-sec-2023-29.html
- https://gitlab.com/wireshark/wireshark/-/issues/19404
- https://lists.debian.org/debian-lts-announce/2024/02/msg00016.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00049.html
- https://www.wireshark.org/security/wnpa-sec-2023-29.html
