It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-197 advisory.

    Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version     between 4.0.0 to 4.0.5, by default, is susceptible to a heap-based buffer overflow, and possibly code     execution in the context of the process runningWireshark.NOTE: https://www.wireshark.org/security/wnpa-     sec-2023-18.htmlNOTE: https://gitlab.com/wireshark/wireshark/-/issues/19085 (CVE-2023-0666)

    Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version     4.0.5 and prior, in an unusual configuration, is susceptible to a heap-based buffer overflow, and possibly     code execution in the context of the process running Wireshark. (CVE-2023-0667)

    Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark     version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code     execution in the context of the process running Wireshark. (CVE-2023-0668)

    A vulnerability exists in wireshark version 4.0.0 to 4.0.5 which would allow a remote attacker to crash     wireshark by either injecting a malformed packet onto the wire or by convincing a user to read a malformed     packet trace file. (CVE-2023-2854)

    Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via     crafted capture file (CVE-2023-2855)

    VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service     via crafted capture file (CVE-2023-2856)

    A vulnerability was found in wireshark versions between 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13. The attacker     would need the victim to open a maliciously crafted wireshark trace file, which would cause wireshark to     crash. (CVE-2023-2857)

    NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via     crafted capture file (CVE-2023-2858)

    GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet     injection or crafted capture file (CVE-2023-2879)

    XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via     packet injection or crafted capture file (CVE-2023-2952)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-197)

high Nessus Plugin ID 176926

Version 1.8