CVE-2015-6247 in Wireshark
Summary
by MITRE
The dissect_openflow_tablemod_v5 function in epan/dissectors/packet-openflow_v5.c in the OpenFlow dissector in Wireshark 1.12.x before 1.12.7 does not validate a certain offset value, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/13/2022
The vulnerability identified as CVE-2015-6247 resides within the OpenFlow dissector component of Wireshark, specifically in the dissect_openflow_tablemod_v5 function located in epan/dissectors/packet-openflow_v5.c. This flaw affects Wireshark versions 1.12.x prior to 1.12.7 and represents a critical denial of service vulnerability that can be exploited remotely by attackers who craft malicious packets. The OpenFlow protocol is commonly used in software-defined networking environments to enable communication between network switches and controllers, making this vulnerability particularly concerning for network infrastructure monitoring and analysis tools.
The technical flaw stems from insufficient validation of offset values within the dissect_openflow_tablemod_v5 function. When processing OpenFlow protocol packets, the dissector fails to properly validate a specific offset parameter that determines how the packet data should be parsed and interpreted. This validation gap allows an attacker to craft a specially formatted OpenFlow packet containing an invalid or maliciously constructed offset value that causes the dissector to enter an infinite loop during packet processing. The lack of proper input validation creates a condition where the parser continuously iterates through a loop without proper termination conditions, consuming excessive CPU resources and effectively rendering the Wireshark application unresponsive.
The operational impact of this vulnerability extends beyond simple service disruption, as it can severely compromise network monitoring capabilities in environments where Wireshark is deployed for traffic analysis and troubleshooting. Network administrators who rely on Wireshark for diagnosing network issues or conducting security assessments could find their monitoring tools completely incapacitated by a single malicious packet. The infinite loop condition can persist for extended periods, potentially causing system resource exhaustion and preventing legitimate network analysis activities from completing successfully. This vulnerability is particularly dangerous in automated monitoring environments where Wireshark might be processing large volumes of network traffic continuously, as the denial of service could go unnoticed for extended periods.
Mitigation strategies for CVE-2015-6247 primarily focus on immediate software updates and deployment of patched versions of Wireshark. Organizations should prioritize upgrading to Wireshark 1.12.7 or later versions that contain the necessary validation fixes for the offset parameter. Additionally, network administrators should implement network segmentation and packet filtering rules to prevent unauthorized access to systems running Wireshark, particularly in environments where the tool processes untrusted network traffic. The vulnerability aligns with CWE-129, which describes improper validation of array indices or offset values, and falls under ATT&CK technique T1499.002 for network denial of service attacks. Security teams should also consider implementing monitoring solutions that can detect abnormal CPU usage patterns or infinite loop conditions in network analysis tools, providing early warning capabilities for potential exploitation of similar vulnerabilities in the future.