Wireshark 4.6.8 Patches 28 Security Vulnerabilities, Nine in File Parsers
Wireshark 4.6.8 has been released, addressing 28 security vulnerabilities, with a significant focus on nine flaws within its file parsers that could be exploited by malicious capture files.
The latest release of the popular network protocol analyzer, Wireshark 4.6.8, rectifies a total of 28 security vulnerabilities. A notable portion of these, nine in number, are critical flaws residing within the application's file parsers. These vulnerabilities are particularly concerning as they can be triggered simply by a user opening a crafted capture file, bypassing the need for direct network access or interaction with live network traffic.
The affected file parsers include those for widely used formats such as pcapng and Endace ERF, as well as less common ones like Tektronix K12xx, BUSMASTER, Catapult DCT2000, Gammu DCT3, 3gpp phone logs, and TTX Logger. Additionally, on Windows systems, the parsers for Ixia IxVeriWave and Vector Informatik BLF are also impacted. This broad range of affected parsers means that users handling various types of capture files are potentially at risk.
Beyond the file parser vulnerabilities, the update also addresses numerous other issues across Wireshark's dissector engine and core functionalities. These include crashes in dissectors for protocols such as RDP, SSH, Kerberos, H.245, ESS, X.509IF, RRC, and UMTS FP. Several advisories cover multiple vulnerabilities, with specific attention given to CMS, C12.22, and various Bluetooth protocols (ATT, HFP, BR/EDR FHS, and AVRCP).
Further strengthening the application's security, Wireshark 4.6.8 includes a fix for a vulnerability in the reassembly engine, which is crucial for reconstructing fragmented network data. Two separate advisories address vulnerabilities in the 'sharkd' utility, which could lead to crashes when processing specific inputs, potentially exposing scripted applications that rely on this component.
Many of these fixes were identified through the project's internal fuzzing efforts, indicating a proactive approach to uncovering potential weaknesses. The release follows Wireshark 4.6.7, which addressed 12 advisories, highlighting the continuous effort to maintain the security posture of the tool.
Interestingly, the release notes also detail several memory-safety fixes that did not receive formal advisory numbers. These include a stack buffer overflow in the K12/RF5 writer, stack over-reads, out-of-bounds reads in various parsers (androiddump, BLF writer), and stack exhaustion issues related to deeply nested NetLog JSON and DLMS/COSEM compact-array parsing. This means the total number of vulnerabilities addressed may be higher than indicated by the formal advisories alone.
In a less critical but still notable issue, Wireshark was found to be misdecoding several information elements within 5G NAS and 5GSM protocols. While these errors did not lead to crashes, they resulted in incorrect data being displayed, which could mislead network engineers relying on accurate packet analysis for troubleshooting or security monitoring.
Finally, the release notes also mention a change in the default location for extcap binaries on UN*X systems, moving from /usr/lib64/wireshark/extcap to /usr/libexec/wireshark/extcap. This change, which took effect in version 4.6.0, may require adjustments for third-party extcap installations. Additionally, two user-interface related fixes are included for Windows users, addressing slowness in Capture File Properties and a segfault when toggling a TCP preference.