CVE-2011-2698: Medium severity wireshark vulnerability
An infinite loop was found in the way ANSI A Interface (IS-634/IOS) dissector of the Wireshark network traffic analyzer processed certain ANSI A MAP capture files. If Wireshark read a malformed packet off a network or opened a malicious packet capture file, it could lead to denial of service (Wireshark hang).
Upstream bug: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=6044
Public PoC: [2] http://www.wireshark.org/download/automated/captures/fuzz-2011-06-20-22762.pcap
Relevant upstream patch: [3] http://anonsvn.wireshark.org/viewvc?view=revision&revision=37930
References: [4] http://www.wireshark.org/security/ [5] http://www.wireshark.org/security/wnpa-sec-2011-11.html [6] http://www.wireshark.org/security/wnpa-sec-2011-10.html
Other sources
Off-by-one error in the elemcellidaux function in epan/dissectors/packet-ansia.c in the ANSI MAP dissector in Wireshark 1.4.x before 1.4.8 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (infinite loop) via an invalid packet.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2011-2698?
CVE-2011-2698 is classified as a denial of service vulnerability that may cause Wireshark to crash.
How do I fix CVE-2011-2698?
To fix CVE-2011-2698, update Wireshark to the latest version available that does not include this vulnerability.
Which versions of Wireshark are affected by CVE-2011-2698?
CVE-2011-2698 affects Wireshark versions 1.4.0 through 1.6.0.
What happens if I encounter a malformed packet with CVE-2011-2698?
Encountering a malformed packet with CVE-2011-2698 can lead to an infinite loop, causing Wireshark to become unresponsive.
Is there a workaround for CVE-2011-2698 while I update my software?
As a workaround for CVE-2011-2698, avoid opening untrusted or potentially malicious packet capture files.