Wireshark Patches 19 Vulnerabilities, Including a Critical Code Execution Flaw
Somatirtha
Wireshark 4.6.9: Wireshark released version 4.6.9 to address 19 disclosed security vulnerabilities, including a flaw that could potentially allow arbitrary code execution through malicious configuration profile imports.
Critical Code Execution Flaw: A vulnerability in configuration profile importing could allow malicious files to execute code, creating security risks when users import untrusted profiles into Wireshark.
Malicious Configuration Profiles: Attackers could exploit specially crafted profile files to trigger unintended behaviour, making it important for users to avoid importing configuration profiles from untrusted sources.
Affected Wireshark Versions: CERT-In identified Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 as affected by multiple reported vulnerabilities.
Protocol Dissector Flaws: Several vulnerabilities involve protocol dissectors, which analyse network traffic and can crash or behave unexpectedly when processing specially crafted or malformed packets.
Denial-of-Service Risks: Certain flaws could cause application crashes, infinite loops or excessive resource consumption, potentially disrupting packet analysis and affecting system availability.
File Parser Vulnerabilities: Security issues in file parsers and related utilities could be triggered by malformed inputs, highlighting the importance of keeping network analysis software updated.
Update Recommendation: Users should upgrade to Wireshark 4.6.9 or later, or an appropriate fixed release in the 4.4 branch, to address the reported vulnerabilities.
Enterprise Security Implications: Organisations using Wireshark for troubleshooting and security monitoring should prioritise patch management, review software versions and avoid processing untrusted files with vulnerable installations.