Vulnerabilities > CVE-2017-11406 - Infinite Loop vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by rejecting invalid Frame Control parameter values.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family Windows NASL id WIRESHARK_2_2_8.NASL description The version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.14 or 2.2.x prior to 2.2.8. It is, therefore, affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists in the DAAP dissector, specifically in the dissect_daap_one_tag() function within file epan/dissectors/packet-daap.c. An unauthenticated, remote attacker can exploit this to exhaust stack resources through uncontrolled recursion. (CVE-2017-9617) - An infinite loop condition exists in the DOCSIS dissector, specifically in the dissect_docsis() function within file plugins/docsis/packet-docsis.c. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to consume available CPU resources, resulting in a denial of service condition. (CVE-2017-11406) - A memory allocation issue exists in the MQ dissector, specifically in the reassemble_mq() function within file epan/dissectors/packet-mq.c, due to improper validation of fragment lengths before attempting reassembly. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a denial of service condition. (CVE-2017-11407) - A flaw exists in the AMQP dissector, specifically in the get_amqp_1_0_value_formatter() function within file epan/dissectors/packet-amqp.c, when decoding lists. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a stack overflow, resulting in a denial of service condition. (CVE-2017-11408) - A large loop condition exists in the GPRS LLC dissector, specifically in the llc_gprs_dissect_xid() function within file epan/dissectors/packet-gprs-llc.c, when handling specially crafted packet or trace files. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. Note that this issue only applies to version 2.0.x. (CVE-2017-11409) Note that Nessus has not tested for these issues but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 101898 published 2017-07-21 reporter This script is Copyright (C) 2017-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/101898 title Wireshark 2.0.x < 2.0.14 / 2.2.x < 2.2.8 Multiple DoS code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(101898); script_version("1.5"); script_cvs_date("Date: 2018/08/07 16:46:51"); script_cve_id( "CVE-2017-9617", "CVE-2017-11406", "CVE-2017-11407", "CVE-2017-11408", "CVE-2017-11409" ); script_bugtraq_id( 99087 ); script_name(english:"Wireshark 2.0.x < 2.0.14 / 2.2.x < 2.2.8 Multiple DoS"); script_summary(english:"Checks the version of Wireshark."); script_set_attribute(attribute:"synopsis", value: "An application installed on the remote Windows host is affected by multiple denial of service vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.14 or 2.2.x prior to 2.2.8. It is, therefore, affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists in the DAAP dissector, specifically in the dissect_daap_one_tag() function within file epan/dissectors/packet-daap.c. An unauthenticated, remote attacker can exploit this to exhaust stack resources through uncontrolled recursion. (CVE-2017-9617) - An infinite loop condition exists in the DOCSIS dissector, specifically in the dissect_docsis() function within file plugins/docsis/packet-docsis.c. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to consume available CPU resources, resulting in a denial of service condition. (CVE-2017-11406) - A memory allocation issue exists in the MQ dissector, specifically in the reassemble_mq() function within file epan/dissectors/packet-mq.c, due to improper validation of fragment lengths before attempting reassembly. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a denial of service condition. (CVE-2017-11407) - A flaw exists in the AMQP dissector, specifically in the get_amqp_1_0_value_formatter() function within file epan/dissectors/packet-amqp.c, when decoding lists. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a stack overflow, resulting in a denial of service condition. (CVE-2017-11408) - A large loop condition exists in the GPRS LLC dissector, specifically in the llc_gprs_dissect_xid() function within file epan/dissectors/packet-gprs-llc.c, when handling specially crafted packet or trace files. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. Note that this issue only applies to version 2.0.x. (CVE-2017-11409) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/docs/relnotes/wireshark-2.0.14.html"); script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/docs/relnotes/wireshark-2.2.8.html"); script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/security/wnpa-sec-2017-34.html"); script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/security/wnpa-sec-2017-35.html"); script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/security/wnpa-sec-2017-36.html"); script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/security/wnpa-sec-2017-37.html"); script_set_attribute(attribute:"see_also", value:"https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13799"); script_set_attribute(attribute:"solution", value: "Upgrade to Wireshark version 2.0.14 / 2.2.8 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/15"); script_set_attribute(attribute:"patch_publication_date", value:"2017/07/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/21"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:wireshark:wireshark"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2017-2018 Tenable Network Security, Inc."); script_dependencies("wireshark_installed.nasl"); script_require_keys("installed_sw/Wireshark", "SMB/Registry/Enumerated"); exit(0); } include("vcf.inc"); get_kb_item_or_exit("SMB/Registry/Enumerated"); app_info = vcf::get_app_info(app:"Wireshark", win_local:TRUE); constraints = [ { "min_version" : "2.0.0", "fixed_version" : "2.0.14" }, { "min_version" : "2.2.0", "fixed_version" : "2.2.8" } ]; vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);NASL family MacOS X Local Security Checks NASL id MACOSX_WIRESHARK_2_2_8.NASL description The version of Wireshark installed on the remote macOS or Mac OS X host is 2.0.x prior to 2.0.14 or 2.2.x prior to 2.2.8. It is, therefore, affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists in the DAAP dissector, specifically in the dissect_daap_one_tag() function within file epan/dissectors/packet-daap.c. An unauthenticated, remote attacker can exploit this to exhaust stack resources through uncontrolled recursion. (CVE-2017-9617) - An infinite loop condition exists in the DOCSIS dissector, specifically in the dissect_docsis() function within file plugins/docsis/packet-docsis.c. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to consume available CPU resources, resulting in a denial of service condition. (CVE-2017-11406) - A memory allocation issue exists in the MQ dissector, specifically in the reassemble_mq() function within file epan/dissectors/packet-mq.c, due to improper validation of fragment lengths before attempting reassembly. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a denial of service condition. (CVE-2017-11407) - A flaw exists in the AMQP dissector, specifically in the get_amqp_1_0_value_formatter() function within file epan/dissectors/packet-amqp.c, when decoding lists. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a stack overflow, resulting in a denial of service condition. (CVE-2017-11408) - A large loop condition exists in the GPRS LLC dissector, specifically in the llc_gprs_dissect_xid() function within file epan/dissectors/packet-gprs-llc.c, when handling specially crafted packet or trace files. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. Note that this issue only applies to version 2.0.x. (CVE-2017-11409) Note that Nessus has not tested for these issues but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 101897 published 2017-07-21 reporter This script is Copyright (C) 2017-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/101897 title Wireshark 2.0.x < 2.0.14 / 2.2.x < 2.2.8 Multiple DoS (macOS) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(101897); script_version("1.5"); script_cvs_date("Date: 2018/07/14 1:59:37"); script_cve_id( "CVE-2017-9617", "CVE-2017-11406", "CVE-2017-11407", "CVE-2017-11408", "CVE-2017-11409" ); script_bugtraq_id( 99087 ); script_name(english:"Wireshark 2.0.x < 2.0.14 / 2.2.x < 2.2.8 Multiple DoS (macOS)"); script_summary(english:"Checks the version of Wireshark."); script_set_attribute(attribute:"synopsis", value: "An application installed on the remote macOS or Mac OS X host is affected by multiple denial of service vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Wireshark installed on the remote macOS or Mac OS X host is 2.0.x prior to 2.0.14 or 2.2.x prior to 2.2.8. It is, therefore, affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists in the DAAP dissector, specifically in the dissect_daap_one_tag() function within file epan/dissectors/packet-daap.c. An unauthenticated, remote attacker can exploit this to exhaust stack resources through uncontrolled recursion. (CVE-2017-9617) - An infinite loop condition exists in the DOCSIS dissector, specifically in the dissect_docsis() function within file plugins/docsis/packet-docsis.c. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to consume available CPU resources, resulting in a denial of service condition. (CVE-2017-11406) - A memory allocation issue exists in the MQ dissector, specifically in the reassemble_mq() function within file epan/dissectors/packet-mq.c, due to improper validation of fragment lengths before attempting reassembly. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a denial of service condition. (CVE-2017-11407) - A flaw exists in the AMQP dissector, specifically in the get_amqp_1_0_value_formatter() function within file epan/dissectors/packet-amqp.c, when decoding lists. An unauthenticated, remote attacker can exploit this, via a specially crafted packet or packet trace, to cause a stack overflow, resulting in a denial of service condition. (CVE-2017-11408) - A large loop condition exists in the GPRS LLC dissector, specifically in the llc_gprs_dissect_xid() function within file epan/dissectors/packet-gprs-llc.c, when handling specially crafted packet or trace files. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. Note that this issue only applies to version 2.0.x. (CVE-2017-11409) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/docs/relnotes/wireshark-2.0.14.html"); script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/docs/relnotes/wireshark-2.2.8.html"); script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/security/wnpa-sec-2017-34.html"); script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/security/wnpa-sec-2017-35.html"); script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/security/wnpa-sec-2017-36.html"); script_set_attribute(attribute:"see_also", value:"https://www.wireshark.org/security/wnpa-sec-2017-37.html"); script_set_attribute(attribute:"see_also", value:"https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13799"); script_set_attribute(attribute:"solution", value: "Upgrade to Wireshark version 2.0.14 / 2.2.8 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/15"); script_set_attribute(attribute:"patch_publication_date", value:"2017/07/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/21"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:wireshark:wireshark"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2017-2018 Tenable Network Security, Inc."); script_dependencies("macosx_wireshark_installed.nbin"); script_require_keys("installed_sw/Wireshark", "Host/MacOSX/Version", "Host/local_checks_enabled"); exit(0); } include("vcf.inc"); get_kb_item_or_exit("Host/MacOSX/Version"); app_info = vcf::get_app_info(app:"Wireshark"); constraints = [ { "min_version" : "2.0.0", "fixed_version" : "2.0.14" }, { "min_version" : "2.2.0", "fixed_version" : "2.2.8" } ]; vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);NASL family Debian Local Security Checks NASL id DEBIAN_DLA-1634.NASL description Several issues in wireshark, a tool that captures and analyzes packets off the wire, have been found by different people. These are basically issues with length checks or invalid memory access in different dissectors. This could result in infinite loops or crashes by malicious packets. For Debian 8 last seen 2020-03-17 modified 2019-01-16 plugin id 121193 published 2019-01-16 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/121193 title Debian DLA-1634-1 : wireshark security update NASL family SuSE Local Security Checks NASL id SUSE_SU-2017-2032-1.NASL description This wireshark update to version 2.2.8 fixes the following issues: Security issues fixed : - CVE-2017-11411: The openSAFETY dissectorcould crash or exhaust system memory because of missing length validation. (bsc#1049621) - CVE-2017-11410: The WBXML dissector could go into an infinite loop. (bsc#1049255) - CVE-2017-11408: The AMQP dissector could crash. (bsc#1049255) - CVE-2017-11407: The MQ dissector could crash. (bsc#1049255) - CVE-2017-11406: The DOCSIS dissector could go into an infinite loop. (bsc#1049255) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 102189 published 2017-08-04 reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/102189 title SUSE SLES11 Security Update : wireshark (SUSE-SU-2017:2032-1) NASL family SuSE Local Security Checks NASL id SUSE_SU-2017-2033-1.NASL description This wireshark update to version 2.2.8 fixes the following issues: Security issues fixed : - CVE-2017-11411: The openSAFETY dissectorcould crash or exhaust system memory because of missing length validation. (bsc#1049621) - CVE-2017-11410: The WBXML dissector could go into an infinite loop. (bsc#1049255) - CVE-2017-11408: The AMQP dissector could crash. (bsc#1049255) - CVE-2017-11407: The MQ dissector could crash. (bsc#1049255) - CVE-2017-11406: The DOCSIS dissector could go into an infinite loop. (bsc#1049255) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 102190 published 2017-08-04 reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/102190 title SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2017:2033-1) NASL family SuSE Local Security Checks NASL id OPENSUSE-2017-840.NASL description This update to Wireshark 2.2.8 fixes some minor vulnerabilities could be used to trigger dissector crashes, infinite loops, or cause excessive use of memory resources by making Wireshark read specially crafted packages from the network or a capture file : - CVE-2017-7702,CVE-2017-11410: WBMXL dissector infinite loop (wnpa-sec-2017-13) - CVE-2017-9350,CVE-2017-11411: openSAFETY dissector memory exhaustion (wnpa-sec-2017-28) - CVE-2017-11408: AMQP dissector crash (wnpa-sec-2017-34) - CVE-2017-11407: MQ dissector crash (wnpa-sec-2017-35) - CVE-2017-11406: DOCSIS infinite loop (wnpa-sec-2017-36) last seen 2020-06-05 modified 2017-07-26 plugin id 101970 published 2017-07-26 reporter This script is Copyright (C) 2017-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/101970 title openSUSE Security Update : Wireshark (openSUSE-2017-840) NASL family Fedora Local Security Checks NASL id FEDORA_2017-F1F3DAFB50.NASL description Rebase to the newest upstream version in 2.2.X line containing only bug fixes. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2017-08-08 plugin id 102248 published 2017-08-08 reporter This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/102248 title Fedora 26 : wireshark (2017-f1f3dafb50)
References
- https://www.wireshark.org/security/wnpa-sec-2017-36.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13797
- http://www.securitytracker.com/id/1038966
- http://www.securityfocus.com/bid/99903
- https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=250216263c3a3f2c651e80d9c6b3dc0adc53dc2c