CVE-2014-6429

Vulnerability

The SnifferDecompress function in wiretap/ngsniffer.c within the DOS Sniffer file parser of Wireshark mishandles empty input data, leading to an invalid memory access. Affected versions include 1.10.x before 1.10.10 and 1.12.x before 1.12.1 [3].

Exploitation

An attacker can trigger the crash by convincing a Wireshark user to open a specially crafted Sniffer packet trace file. The user must explicitly load the file; no special network position or authentication is required beyond delivering the file via email, download, or other means [3].

Impact

Successful exploitation causes the Wireshark application to crash, resulting in a denial of service. No code execution or data compromise has been disclosed [3] [4].

Mitigation

Fixed versions are Wireshark 1.12.1 and 1.10.10, released on or around September 16, 2014 [3]. Red Hat Enterprise Linux 6 and 7 also delivered updated packages (wireshark-1.8.10-8.el6_6 and wireshark-1.10.3-12.el7_0) [1] [2]. Users unable to upgrade should avoid opening Sniffer capture files from untrusted sources.