CVE-2014-6430

Vulnerability

The SnifferDecompress function in wiretap/ngsniffer.c of the DOS Sniffer file parser in Wireshark does not validate bitmask data before using it. This affects Wireshark versions 1.10.x before 1.10.10, 1.12.x before 1.12.1, and also versions on Red Hat Enterprise Linux 6 and 7 shipped with specific packages [1][3]. The vulnerability can be triggered by opening a malformed packet trace file [4].

Exploitation

An attacker can exploit this by crafting a malicious DOS Sniffer capture file and convincing a user to open it in Wireshark. No special privileges or authentication are required; the attacker only needs to deliver the file via email, a website, or other means. Once the file is parsed, the missing bitmask validation leads to invalid memory accesses in the SnifferDecompress function [4].

Impact

Successful exploitation causes Wireshark to crash, resulting in a denial of service. The crash is due to invalid memory accesses, which could potentially be leveraged for further exploitation, though the primary impact is application termination [3]. No data confidentiality or integrity is directly compromised, but the tool becomes unavailable for analysis.

Mitigation

Fixed versions are Wireshark 1.12.1 and 1.10.10, released September 16, 2014 [3]. Red Hat provided updated packages through RHSA-2014-1676 and RHSA-2014-1677 for affected Enterprise Linux versions [1][2]. Users should upgrade to these fixed versions. No workaround other than avoiding opening untrusted Sniffer files is available.