CVE-2024-0208: Denial of Service Vulnerability in Wireshark’s GVCP Dissector

Overview

CVE-2024-0208 is a significant vulnerability that affects Wireshark versions 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19. Wireshark, an open-source packet analyzer utilized by network administrators worldwide, has a vulnerability in its GigE Vision Control Protocol (GVCP) dissector. This vulnerability could allow an attacker to induce a denial-of-service (DoS) state via packet injection or by using a crafted capture file. The potential impact of this vulnerability includes system compromise and data leakage, posing a serious threat to both confidentiality and availability of data.

Vulnerability Summary

CVE ID: CVE-2024-0208
Severity: High (7.8 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Denial of Service, potential for system compromise or data leakage

Affected Products

Product | Affected Versions

Wireshark | 4.2.0
Wireshark | 4.0.0 to 4.0.11
Wireshark | 3.6.0 to 3.6.19

How the Exploit Works

This exploit works by leveraging the vulnerability in Wireshark’s GVCP dissector. An attacker sends specially crafted packets or a manipulated capture file to the target system running the affected Wireshark versions. These malicious packets or files cause the GVCP dissector to crash, leading to a denial of service. If further exploited, it can potentially lead to system compromise or data leakage.

Conceptual Example Code

Below is a conceptual example of how the vulnerability might be exploited. In this case, a malicious packet is sent to the target system:

POST /GVCP/dissector HTTP/1.1
Host: target.example.com
Content-Type: application/gvcp
{ "malicious_packet": "crafted_packet_that_crashes_dissector" }

This example shows a HTTP POST request sent to the endpoint where the GVCP dissector is located. The content of the request contains a malicious packet designed to crash the GVCF dissector, resulting in a denial of service.
Remember, this is only a conceptual example and in a real-world scenario, the actual malicious payload would be much more complex and specifically crafted to exploit the vulnerability in question.