CVE-2017-17084: High severity Wireshark Wireshark vulnerability
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the IWARPMPA dissector could crash. This was addressed in epan/dissectors/packet-iwarp-mpa.c by validating a ULPDU length.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wiresharkto a version that resolves this vulnerability.Fixed in 2.6.20-0+deb10u4Fixed in 2.6.20-0+deb10u7Fixed in 3.4.10-0+deb11u1Fixed in 4.0.6-1~deb12u1Fixed in 4.0.10-1 - Upgrade
Upgrade
alpine/wiresharkto a version that resolves this vulnerability.Fixed in 2.4.3-r0 - Upgrade
Upgrade
alpine/wiresharkto a version that resolves this vulnerability.Fixed in 2.2.11-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2017-17084?
CVE-2017-17084 is classified as a medium severity vulnerability due to the risk of crashing Wireshark.
How do I fix CVE-2017-17084?
To fix CVE-2017-17084, upgrade Wireshark to version 2.4.3 or later, or apply relevant patches.
Which versions of Wireshark are affected by CVE-2017-17084?
CVE-2017-17084 affects Wireshark versions 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10.
What is the impact of CVE-2017-17084 on Wireshark?
The impact of CVE-2017-17084 is that the IWARP_MPA dissector can crash Wireshark, leading to potential denial of service.
Who is affected by CVE-2017-17084?
Users running affected versions of Wireshark on any supported platform are at risk from CVE-2017-17084.