CVE-2024-8250
Wireshark
CVE-2024-8250: A denial-of-service vulnerability exists in Wireshark versions 4.2.0 to 4.0.6 and 4.0.0 to 4.0.16 due to a crash in the NTLMSSP dissector. This vulnerability allows attackers to trigger a crash by injecting malicious packets or providing a crafted capture file. While the CVSS score is 5.5, indicating medium severity, the SOCRadar Vulnerability Risk Score (SVRS) is 54, suggesting a moderate risk level. This NTLMSSP dissector crash can disrupt network analysis and monitoring capabilities. An attacker could exploit this to temporarily disable a network administrator’s ability to use Wireshark for troubleshooting, creating a window for further malicious activity. Users should update to the latest Wireshark version to mitigate the risk of exploitation and prevent denial-of-service attacks. The significance of this CVE lies in its potential to disrupt critical network analysis workflows and impair incident response efforts.
Description:
CVE-2024-8250 is a denial-of-service vulnerability in Wireshark, a popular network protocol analyzer. The vulnerability allows an attacker to crash Wireshark by sending a specially crafted packet or capture file.
Key Insights:
- SVRS Score: 0. This indicates that the vulnerability is not considered critical and does not require immediate action.
- Exploit Status: No active exploits have been published.
- CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
- In the Wild: The vulnerability is not currently being exploited in the wild.
Mitigation Strategies:
- Update Wireshark to version 4.2.1 or later.
- Use a firewall to block access to Wireshark from untrusted networks.
- Monitor network traffic for suspicious activity.
Additional Information:
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.