What versions of Wireshark are affected by CVE-2017-7746?

CVE-2017-7746 affects Wireshark versions 2.0.0 to 2.0.11 and 2.2.0 to 2.2.5.

What is the nature of the vulnerability identified in CVE-2017-7746?

CVE-2017-7746 involves a potential infinite loop in the SLSK dissector triggered by packet injection or malformed capture files.

How can I mitigate the risks associated with CVE-2017-7746?

To mitigate CVE-2017-7746, upgrade to a version of Wireshark that is not affected, specifically versions beyond 2.2.5.

What did the fix for CVE-2017-7746 include?

The fix for CVE-2017-7746 included adding checks for the remaining length in the SLSK dissector code.

Is CVE-2017-7746 a critical vulnerability?

CVE-2017-7746 has the potential to cause denial of service due to an infinite loop, which can be considered critical in certain scenarios.

Vulnerability/
CVE-2017-7746

high

7.5

CWE

835

12/4/2017

5/8/2024

CVE-2017-7746

First published: Wed Apr 12 2017(Updated: )

In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SLSK dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-slsk.c by adding checks for the remaining length.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Wireshark Wireshark	=2.0.0
Wireshark Wireshark	=2.0.1
Wireshark Wireshark	=2.0.2
Wireshark Wireshark	=2.0.3
Wireshark Wireshark	=2.0.4
Wireshark Wireshark	=2.0.5
Wireshark Wireshark	=2.0.6
Wireshark Wireshark	=2.0.7
Wireshark Wireshark	=2.0.8
Wireshark Wireshark	=2.0.9
Wireshark Wireshark	=2.0.10
Wireshark Wireshark	=2.0.11
Wireshark Wireshark	=2.2.0
Wireshark Wireshark	=2.2.1
Wireshark Wireshark	=2.2.2
Wireshark Wireshark	=2.2.3
Wireshark Wireshark	=2.2.4
Wireshark Wireshark	=2.2.5
Debian GNU/Linux	=8.0

Remedy

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13576

Remedy

https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=58e69cc769dea24b721abd8a29f9eedc11024b7e

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What versions of Wireshark are affected by CVE-2017-7746?
CVE-2017-7746 affects Wireshark versions 2.0.0 to 2.0.11 and 2.2.0 to 2.2.5.
What is the nature of the vulnerability identified in CVE-2017-7746?
CVE-2017-7746 involves a potential infinite loop in the SLSK dissector triggered by packet injection or malformed capture files.
How can I mitigate the risks associated with CVE-2017-7746?
To mitigate CVE-2017-7746, upgrade to a version of Wireshark that is not affected, specifically versions beyond 2.2.5.
What did the fix for CVE-2017-7746 include?
The fix for CVE-2017-7746 included adding checks for the remaining length in the SLSK dissector code.
Is CVE-2017-7746 a critical vulnerability?
CVE-2017-7746 has the potential to cause denial of service due to an infinite loop, which can be considered critical in certain scenarios.

agent/type
agent/remedy
collector/mitre-cve
source/MITRE
agent/weakness
agent/last-modified-date
agent/author
agent/severity
agent/references
agent/description
agent/first-publish-date
agent/event
agent/source
agent/softwarecombine
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/wireshark
canonical/wireshark wireshark
version/wireshark wireshark/2.0.0
version/wireshark wireshark/2.0.1
version/wireshark wireshark/2.0.2
version/wireshark wireshark/2.0.3
version/wireshark wireshark/2.0.4
version/wireshark wireshark/2.0.5
version/wireshark wireshark/2.0.6
version/wireshark wireshark/2.0.7
version/wireshark wireshark/2.0.8
version/wireshark wireshark/2.0.9
version/wireshark wireshark/2.0.10
version/wireshark wireshark/2.0.11
version/wireshark wireshark/2.2.0
version/wireshark wireshark/2.2.1
version/wireshark wireshark/2.2.2
version/wireshark wireshark/2.2.3
version/wireshark wireshark/2.2.4
version/wireshark wireshark/2.2.5
vendor/debian
canonical/debian gnu/linux
version/debian gnu/linux/8.0

Frequently Asked Questions

What versions of Wireshark are affected by CVE-2017-7746?
CVE-2017-7746 affects Wireshark versions 2.0.0 to 2.0.11 and 2.2.0 to 2.2.5.
What is the nature of the vulnerability identified in CVE-2017-7746?
CVE-2017-7746 involves a potential infinite loop in the SLSK dissector triggered by packet injection or malformed capture files.
How can I mitigate the risks associated with CVE-2017-7746?
To mitigate CVE-2017-7746, upgrade to a version of Wireshark that is not affected, specifically versions beyond 2.2.5.
What did the fix for CVE-2017-7746 include?
The fix for CVE-2017-7746 included adding checks for the remaining length in the SLSK dissector code.
Is CVE-2017-7746 a critical vulnerability?
CVE-2017-7746 has the potential to cause denial of service due to an infinite loop, which can be considered critical in certain scenarios.

CVE-2017-7746

Remedy

Remedy

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What versions of Wireshark are affected by CVE-2017-7746?

What is the nature of the vulnerability identified in CVE-2017-7746?

How can I mitigate the risks associated with CVE-2017-7746?

What did the fix for CVE-2017-7746 include?

Is CVE-2017-7746 a critical vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What versions of Wireshark are affected by CVE-2017-7746?

What is the nature of the vulnerability identified in CVE-2017-7746?

How can I mitigate the risks associated with CVE-2017-7746?

What did the fix for CVE-2017-7746 include?

Is CVE-2017-7746 a critical vulnerability?