Description
The SSCOP dissector in Wireshark (formerly Ethereal) before 0.99.3 allows remote attackers to cause a denial of service (resource consumption) via malformed packets that cause the Q.2391 dissector to use excessive memory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wireshark | 0.99.2-5.1 | — |
| Debian 13 | wireshark | 0.99.2-5.1 | — |
| Debian 12 | wireshark | 0.99.2-5.1 | — |
| Debian 3.1 | ethereal | 0.10.10-2sarge8 | DSA-1171 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | wireshark +1 | 0.99.3-EL4.2 | RHSA-2006:0658 |
| RHEL 3 | wireshark +1 | 0.99.3-EL3.2 | RHSA-2006:0658 |
Advisories 2
- RHSA-2006:0658 Red Hat Security Advisory: wireshark security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1171 ethereal - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2006-3370 vdb-entry
- https://issues.rpath.com/browse/RPL-597
- http://support.avaya.com/elmodocs2/security/ASA-2006-227.htm
- 21682 third-party-advisory
- oval:org.mitre.oval:def:11801 vdb-entry signature
- 19690 vdb-entry
- 1016736 vdb-entry
- RHSA-2006:0658 vendor-advisory
- 21649 third-party-advisory
- MDKSA-2006:152 vendor-advisory
- wireshark-sscop-dos(28556) vdb-entry
- DSA-1171 vendor-advisory
- 21813 third-party-advisory
- http://www.wireshark.org/security/wnpa-sec-2006-02.html
- VU#696896 third-party-advisory
- 21619 third-party-advisory
- GLSA-200608-26 vendor-advisory
- wireshark-esp-offbyone(28553) vdb-entry
- 21885 third-party-advisory
- 21597 third-party-advisory
- 20060825 rPSA-2006-0158-1 tshark wireshark mailing-list
- 22378 third-party-advisory