CVE-2018-7328 : Security Advisory and Response

Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12 versions were affected by an infinite loop issue in epan/dissectors/packet-usb.c, which was resolved by rejecting short frame header lengths.

Understanding CVE-2018-7328

What is CVE-2018-7328?

In Wireshark versions 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, a vulnerability in epan/dissectors/packet-usb.c caused an infinite loop, mitigated by implementing a solution to reject short frame header lengths.

The Impact of CVE-2018-7328

The vulnerability could lead to denial of service (DoS) attacks due to the infinite loop, potentially causing Wireshark to become unresponsive.

Technical Details of CVE-2018-7328

Vulnerability Description

The issue in epan/dissectors/packet-usb.c caused an infinite loop, which was fixed by disallowing short frame header lengths.

Affected Systems and Versions

Wireshark versions 2.4.0 to 2.4.4
Wireshark versions 2.2.0 to 2.2.12

Exploitation Mechanism

Attackers could exploit this vulnerability by sending specially crafted USB packets to trigger the infinite loop, leading to a DoS condition.

Mitigation and Prevention

Immediate Steps to Take

Update Wireshark to versions 2.4.5 or later for 2.4.x branch, or versions 2.2.13 or later for 2.2.x branch.
Monitor network traffic for any unusual patterns that could indicate exploitation.

Long-Term Security Practices

Regularly update Wireshark and other software to the latest versions to patch known vulnerabilities.
Implement network segmentation to limit the impact of potential attacks.

Patching and Updates

Apply patches provided by Wireshark promptly to address security issues and prevent exploitation.