Wireshark 4.6.9 fixes 19 vulnerabilities, mostly dissector crashes and loops
Victoria Shinder2 min readWireshark 4.6.9 fixes 19 vulnerabilities and 16 bugs, according to the SANS Internet Storm Center, which noted the release on 27 September. The project's own release notes list the vulnerabilities by component, and they read like a survey of how a protocol analyser can fail.
Most are crashes, infinite loops or excessive loops in protocol dissectors and file parsers: ZigBee ZCL, SCTP, SPDY, CSN.1, MBIM, X11, IEEE 802.11, RF4CE and Catapult DCT2000 dissector crashes; infinite loops in the TTL file parser and the TIFF and USB HID dissectors; a memory leak in the IEEE C37.118 synchrophasor dissector; and crashes in the PEAK CAN TRC and Toshiba file parsers. One entry stands apart: a profile import crash described as allowing possible code execution.
The bug list is more specific. It includes reports from the Zero Day Initiative covering an integer overflow in LBMC fragment reassembly, a numeric truncation in LoRaWAN decryption and an integer overflow in SMB object export, along with a length wrap in DICOM object export that led to an undersized allocation, an out-of-bounds read in the display filter engine's error path and a stack buffer overflow in the etwdump extcap when parsing crafted ETL files. The notes also record, belatedly, that since 4.6.0 extcap helpers on Unix-like systems are searched for under the libexec directory, which may require packaging changes for third-party extcaps.
What it means
Wireshark's attack surface is well understood: it parses hundreds of protocols from data it did not generate, often with elevated privileges during capture. A malicious packet on a monitored network or a crafted capture file sent for "analysis" is enough to reach a vulnerable dissector. The steady stream of fixes is largely the product of continuous fuzzing, which is a sign of a healthy project rather than an unusually insecure one.
The practical advice has not changed. Update analyst workstations, avoid capturing as root by using the dumpcap privilege separation Wireshark provides, and treat capture files and configuration profiles from outside the organisation as untrusted input - the profile import issue in this release is a reminder that a settings file can be an attack vector too.