CVE-2017-11410: Input Validation
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding validation of the relationships between indexes and lengths. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-7702.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11410?
CVE-2017-11410 has been assigned a medium severity rating due to the potential for denial of service through infinite loops.
How do I fix CVE-2017-11410?
To fix CVE-2017-11410, update Wireshark to a version that is later than 2.2.7 or 2.0.13.
Which versions of Wireshark are affected by CVE-2017-11410?
Affected versions include Wireshark 2.0.0 to 2.0.13 and 2.2.0 to 2.2.7.
What causes the infinite loop in CVE-2017-11410?
The infinite loop is triggered by packet injection or a malformed capture file that the WBXML dissector cannot handle.
Is there a workaround for CVE-2017-11410?
The recommended action is to update Wireshark, as there is no specific workaround for this vulnerability.