CVE-2018-14438 : Security Advisory and Response

Wireshark up to version 2.6.2 is affected by a vulnerability that allows attackers to manipulate access control without restrictions.

Understanding CVE-2018-14438

An issue has been identified in Wireshark that could potentially enable attackers to modify access control settings.

What is CVE-2018-14438?

This CVE refers to a vulnerability in Wireshark versions up to 2.6.2 that arises from the use of SetSecurityDescriptorDacl to establish a NULL DACL, allowing attackers to manipulate access control without limitations.

The Impact of CVE-2018-14438

The vulnerability in Wireshark could be exploited by malicious actors to arbitrarily modify access control, potentially leading to unauthorized access or other security breaches.

Technical Details of CVE-2018-14438

Wireshark's vulnerability can be further understood through technical details.

Vulnerability Description

The create_app_running_mutex function in wsutil/file_util.c in Wireshark through 2.6.2 utilizes SetSecurityDescriptorDacl to set a NULL DACL, providing attackers with the ability to alter access control permissions.

Affected Systems and Versions

Product: Wireshark
Vendor: N/A
Versions affected: Up to 2.6.2

Exploitation Mechanism

Attackers can exploit this vulnerability by leveraging the NULL DACL set by the create_app_running_mutex function to manipulate access control settings.

Mitigation and Prevention

Protecting systems from CVE-2018-14438 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update Wireshark to a patched version that addresses the vulnerability.
Monitor network traffic for any suspicious activity that could indicate exploitation of the vulnerability.

Long-Term Security Practices

Regularly update software and security patches to prevent known vulnerabilities.
Implement network segmentation and access controls to limit the impact of potential security breaches.
Conduct regular security audits and penetration testing to identify and address vulnerabilities.

Patching and Updates

Ensure that Wireshark is updated to a version beyond 2.6.2 that includes the necessary patches to mitigate the vulnerability.