Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-9349: Wireshark DICOM Dissector Infinite Loop

CVE-2017-9349 · published 9 years ago

Summary

The DICOM dissector in Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12 has an infinite loop that can cause the program to freeze. This issue can occur when processing certain types of DICOM files, potentially leading to a denial of service. Users should update to the latest version of Wireshark to resolve this issue.

What to do

Update alpine wireshark to version 2.2.7-r0.

Affected software

Ecosystem	Vendor	Product	Affected versions
Alpine:v3.5	alpine	wireshark	>= 2.0.0, < 2.2.7-r0 Fix: upgrade to 2.2.7-r0
–	wireshark	wireshark	>= 2.0.0, <= 2.0.12 >= 2.2.0, <= 2.2.6 `cpe:2.3:a:wireshark:wireshark::::::::`
–	debian	debian_linux	8.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`

Original advisory text

In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DICOM dissector has an infinite loop. This was addressed in epan/dissectors/packet-dcm.c by validating a length value.

References

https://security.alpinelinux.org/vuln/CVE-2017-9349 Vendor Advisory
http://www.securityfocus.com/bid/98803 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038612 Third Party Advisory VDB Entry
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1329 Issue Tracking Third Party Advisory
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13685 Issue Tracking Patch Vendor Advisory
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=cb1b6494...
https://lists.debian.org/debian-lts-announce/2019/03/msg00031.html Mailing List Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2017-27.html Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

3% chance of attack within 30 days

Type

CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')

Timeline

Published2 Jun 2017

Updated31 Oct 2026

First seen8 Jul 2026

Sources

ALPINE-CVE-2017-9349 · OSV

CVE-2017-9349 · NVD

Track software like this

Free during beta