CVE-2017-7746: High severity Wireshark Wireshark vulnerability
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SLSK dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-slsk.c by adding checks for the remaining length.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What versions of Wireshark are affected by CVE-2017-7746?
CVE-2017-7746 affects Wireshark versions 2.0.0 to 2.0.11 and 2.2.0 to 2.2.5.
What is the nature of the vulnerability identified in CVE-2017-7746?
CVE-2017-7746 involves a potential infinite loop in the SLSK dissector triggered by packet injection or malformed capture files.
How can I mitigate the risks associated with CVE-2017-7746?
To mitigate CVE-2017-7746, upgrade to a version of Wireshark that is not affected, specifically versions beyond 2.2.5.
What did the fix for CVE-2017-7746 include?
The fix for CVE-2017-7746 included adding checks for the remaining length in the SLSK dissector code.
Is CVE-2017-7746 a critical vulnerability?
CVE-2017-7746 has the potential to cause denial of service due to an infinite loop, which can be considered critical in certain scenarios.