CVE-2016-2523: High severity wireshark vulnerability
Published Feb 28, 2016
·Updated
The dnp3alprocessobject function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Affected Software
12 affected components
Wireshark Wireshark=1.12.0
Wireshark Wireshark=1.12.1
Wireshark Wireshark=1.12.2
Wireshark Wireshark=1.12.3
Wireshark Wireshark=1.12.4
Wireshark Wireshark=1.12.5
Wireshark Wireshark=1.12.6
Wireshark Wireshark=1.12.7
Wireshark Wireshark=1.12.8
Wireshark Wireshark=1.12.9
Wireshark Wireshark=2.0.0
Wireshark Wireshark=2.0.1
Event History
Feb 28, 2016
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-2523?
CVE-2016-2523 is classified as a denial of service vulnerability that can lead to an infinite loop.
2
How do I fix CVE-2016-2523?
To fix CVE-2016-2523, upgrade to Wireshark version 1.12.10 or 2.0.2 or later.
3
Which versions of Wireshark are affected by CVE-2016-2523?
Wireshark versions 1.12.0 to 1.12.9 and 2.0.0 to 2.0.1 are affected by CVE-2016-2523.
4
What exploit does CVE-2016-2523 enable?
CVE-2016-2523 enables remote attackers to cause denial of service through crafted DNP3 packets.
5
Is it safe to use Wireshark without patching CVE-2016-2523?
Using an unpatched version of Wireshark exposes systems to the risk of denial of service from crafted packets.