CVE-2011-1143 in Wireshark
Summary
by MITRE
epan/dissectors/packet-ntlmssp.c in the NTLMSSP dissector in Wireshark before 1.4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted .pcap file.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 12/08/2024
The vulnerability identified as CVE-2011-1143 resides within the NTLMSSP dissector component of Wireshark, specifically in the file epan/dissectors/packet-ntlmssp.c. This flaw represents a critical denial of service vulnerability that affects Wireshark versions prior to 1.4.4, making it particularly concerning for network security professionals who rely on this tool for protocol analysis and troubleshooting. The vulnerability manifests when Wireshark processes specially crafted .pcap files that contain malformed NTLMSSP protocol data, leading to application instability and potential system compromise.
The technical root cause of this vulnerability is a NULL pointer dereference condition that occurs during the processing of NTLMSSP protocol packets within the dissector module. When Wireshark encounters a crafted .pcap file containing malformed NTLMSSP data, the dissector fails to properly validate input parameters before attempting to access memory locations. This results in the application attempting to dereference a NULL pointer, which immediately causes the Wireshark process to crash and terminate unexpectedly. The vulnerability is classified as a CWE-476 NULL Pointer Dereference, which is a common software flaw that occurs when a program attempts to access memory through a pointer that has not been initialized to a valid memory address.
From an operational perspective, this vulnerability presents significant risks to network security operations and forensic analysis activities. Security analysts and network administrators who use Wireshark for monitoring network traffic and investigating security incidents could inadvertently trigger this denial of service condition by opening maliciously crafted packet capture files. The impact extends beyond simple application crashes as it can disrupt ongoing network monitoring operations, potentially causing critical security events to go undetected during the time when the application is recovering from the crash. This vulnerability also aligns with ATT&CK technique T1499.001 for Resource Hijacking, as the denial of service condition effectively consumes system resources and disrupts legitimate network analysis activities.
The exploitability of this vulnerability is relatively straightforward, requiring only the ability to create or obtain a specially crafted .pcap file containing malformed NTLMSSP protocol data. Attackers could potentially distribute such files through various means including email attachments, malicious websites, or compromised network shares, making it particularly dangerous in environments where users may open packet capture files from untrusted sources. The vulnerability affects both manual and automated network analysis workflows, as any attempt to analyze or open the malicious file would trigger the application crash. Organizations relying on Wireshark for security operations and incident response would experience significant disruption when this vulnerability is exploited, as the tool becomes temporarily unusable and may require system restarts or manual intervention to restore normal operations. The remediation approach involves upgrading to Wireshark version 1.4.4 or later, where proper input validation has been implemented to prevent the NULL pointer dereference condition from occurring during NTLMSSP protocol packet processing, thus maintaining the stability and reliability of network analysis operations.