Wireshark 1.4.0 Malformed IKE Packet Denial of Service ------------------------------------------------------------------ I. Summary A flaw has been identified in Wireshark 1.4.0 when send a specific malformed IKE packet that will cause a denial of service . ------------------------------------------------------------------ II. Description Using PROTOS Test-Suite c09-isakmp(https://www.ee.oulu.fi/research/ouspg/PROTOS_Test-Suite_c09-isakmp),when we run the following command "java -jar c09-isakmp-r1.jar --host 210.77.17.129 --id 210.77.19.130 --secret dgggg --sourceport 34444 --index 3332" ,wireshark will capture the packet index 3332,then clike the field"Type Payload:Identification(5)",a error message will popup ,saying"Gtk-ERROR **:Byte index 6 is off the end of the line aborting...".Then wireshark be forced to close. ------------------------------------------------------------------ III. Impact Denial of service ------------------------------------------------------------------ IV. Affected Wireshark 1.4.0, tested with Windows XP SP2. Previous versions may also be affected due to code reuse. ------------------------------------------------------------------ V. Solution Update the software version to 1.5.0 or 1.6.0 ------------------------------------------------------------------ VI. Credit The penetration test team Of NCNIPC (China) is credited for this vulnerability.
