Infinite loop in Wireshark - CVE-2020-15466

Vulnerability identifier: #VU29492

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-15466

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the GVCP dissector. A remote attacker can pass specially crafted packet trace file to the application, consume all available system resources and cause denial of service conditions.

Wireshark
Arch Linux
Gentoo Linux
Ubuntu
Opensuse
openEuler
wireshark (Alpine package)
tshark (Ubuntu package)
wireshark (Ubuntu package)
wireshark-qt (Ubuntu package)
wireshark-common (Ubuntu package)
wireshark-gtk (Ubuntu package)
libwireshark13 (Ubuntu package)
libwireshark11 (Ubuntu package)
wireshark
wireshark-debuginfo
wireshark-debugsource
wireshark-devel
wireshark-help

Install updates from vendor's website.

Wireshark - update to 3.2.5
wireshark (Alpine package) - update to 3.2.5-r0
tshark (Ubuntu package) - update to Ubuntu Pro
wireshark (Ubuntu package) - update to Ubuntu Pro
wireshark-qt (Ubuntu package) - update to Ubuntu Pro
wireshark-common (Ubuntu package) - update to Ubuntu Pro
wireshark-gtk (Ubuntu package) - update to Ubuntu Pro
libwireshark13 (Ubuntu package) - update to Ubuntu Pro
libwireshark11 (Ubuntu package) - update to Ubuntu Pro
wireshark - update to 2.6.2-9
wireshark-debuginfo - update to 2.6.2-9
wireshark-debugsource - update to 2.6.2-9
wireshark-devel - update to 2.6.2-9
wireshark-help - update to 2.6.2-9

• https://www.wireshark.org/security/wnpa-sec-2020-09.html
• https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16029

• Denial of service in Wireshark GVCP dissector
• Arch Linux update for wireshark-cli
• Gentoo update for Wireshark
• OpenSUSE Linux update for wireshark
• OpenSUSE Linux update for wireshark
• Infinite loop in wireshark (Alpine package)
• Ubuntu update for wireshark
• openEuler 20.03 LTS update for wireshark-2.6.2-7