CVE-2020-15466

In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gvcp.c by ensuring that an offset increases in all situations.

Recent assessments:

M4ximuss at July 12, 2020 1:32am UTC reported:

This is a denial of service condition against unpatched Wireshark clients for Windows. From Wireshark website “It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.” In other words, the worst case scenario is you crash Wireshark, and the user simply has to restart the client.

Solution is to upgrade to Wireshark 3.2.5 or later.

Assessed Attacker Value: 1
Assessed Attacker Value: 1Assessed Attacker Value: 2