CVE-2011-2175: Medium severity wireshark vulnerability
An integer underflow flaw, leading to heap-based buffer over-read was found in the Wireshark's Visual Networks dissector. A remote attacker could create a specially-crafted capture file, which once opened, by a local, unsuspecting user could lead to wireshark application crash.
References: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=5934 (upstream bug report) [2] https://bugs.wireshark.org/bugzilla/attachment.cgi?id=6366 (reproducer) [3] http://www.openwall.com/lists/oss-security/2011/05/31/20 (CVE request) [4] http://www.wireshark.org/security/wnpa-sec-2011-07.html (upstream advisory)
Upstream patch: [5] http://anonsvn.wireshark.org/viewvc?view=revision&revision=37128
Other sources
Integer underflow in the visualread function in wiretap/visual.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a malformed Visual Networks file that triggers a heap-based buffer over-read.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2175?
CVE-2011-2175 has a medium severity as it can lead to application crashes.
How do I fix CVE-2011-2175?
To fix CVE-2011-2175, users should upgrade to the latest version of Wireshark that has addressed this vulnerability.
Which versions of Wireshark are affected by CVE-2011-2175?
CVE-2011-2175 affects Wireshark versions 1.2.0 through 1.2.16 and 1.4.0 through 1.4.6.
What can an attacker achieve by exploiting CVE-2011-2175?
An attacker can exploit CVE-2011-2175 to craft malicious capture files that, when opened, can cause Wireshark to crash.
Is CVE-2011-2175 a remote or local vulnerability?
CVE-2011-2175 is a local vulnerability that requires the user to open a crafted capture file.