Description
Integer signedness error in the DNP3 dissector in Wireshark (formerly Ethereal) 0.10.12 to 0.99.6 allows remote attackers to cause a denial of service (long loop) via a malformed DNP3 packet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wireshark | 0.99.6pre1-1 | — |
| Debian 13 | wireshark | 0.99.6pre1-1 | — |
| Debian 12 | wireshark | 0.99.6pre1-1 | — |
| Debian 5.0 | wireshark | 0.99.6rel-5+0.99.7~pre1-1+lenny1 | DTSA-92-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | libsmi +1 | 0.4.5-2.el5 | RHSA-2008:0058 |
| RHEL 5 | wireshark +1 | 0.99.7-1.el5 | RHSA-2008:0058 |
| RHEL 4 | libsmi +1 | 0.4.5-2.el4 | RHSA-2008:0058 |
| RHEL 4 | wireshark +1 | 0.99.7-1.el4 | RHSA-2008:0058 |
| RHEL 3 | libsmi +1 | 0.4.5-3.el3 | RHSA-2008:0059 |
| RHEL 3 | wireshark +1 | 0.99.7-EL3.1 | RHSA-2008:0059 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Wireshark < 0.99.5 - DNP3 Dissector Infinite Loop EDB-4347 · dos · Aug 31, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2008:0058 Red Hat Security Advisory: wireshark security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0059 Red Hat Security Advisory: wireshark security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-92-1 wireshark - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 27777 third-party-advisory
- https://issues.rpath.com/browse/RPL-1975
- 29048 third-party-advisory
- 1018635 vdb-entry
- 26532 vdb-entry
- http://www.wireshark.org/security/wnpa-sec-2007-03.html
- 28564 third-party-advisory
- 20080103 rPSA-2008-0004-1 tshark wireshark mailing-list
- GLSA-200712-23 vendor-advisory
- 20070904 Wireshark DNP3 Dissector Infinite Loop Vulnerability mailing-list
- RHSA-2008:0059 vendor-advisory
- 28304 third-party-advisory
- 1018988 vdb-entry
- oval:org.mitre.oval:def:9841 vdb-entry signature
- FEDORA-2007-4690 vendor-advisory
- 28325 third-party-advisory
- MDVSA-2008:1 vendor-advisory
- 4347 exploit
- MDVSA-2008:001 vendor-advisory
- http://www.securiteam.com/securitynews/5LP0V00MAI.html
- 3095 third-party-advisory
- RHSA-2008:0058 vendor-advisory
- SUSE-SR:2008:004 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=199958
- 28583 third-party-advisory
- ADV-2007-3956 vdb-entry
- 28197 third-party-advisory
- 28288 third-party-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0004
- 28207 third-party-advisory
- FEDORA-2007-4590 vendor-advisory
- wireshark-dnp3-dos(36392) vdb-entry