Wireshark 4.6.6 Security Release: Mitigating CVE-2024-6129 NetScaler DoS

---
title: Wireshark Application Crash - Potential DoS (CVE-2024-6129)
id: 8c8b4d2e-9e1a-4f3b-8c7d-1e2f3a4b5c6d
status: experimental
description: Detects crashes in Wireshark executable which may indicate a DoS attempt via malformed capture files like CVE-2024-6129.
references:
  - https://www.wireshark.org/security/wnpa-sec-2024-03.html
author: Security Arsenal
date: 2024/05/26
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: application
  product: windows
detection:
  selection:
    EventID: 1000
    FaultingImageName|endswith:
      - '\wireshark.exe'
  condition: selection
falsepositives:
  - Legitimate application instability due to corrupt non-malicious pcaps
level: high
---
title: Wireshark Launched by Scripting Utility - Suspicious Execution
id: 2a1b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects Wireshark being launched by a non-shell parent process (e.g., python, wscript), potentially indicating automated pcap parsing or script-based delivery.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2024/05/26
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\wireshark.exe'
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  filter:
    # Filter out common user launches from explorer or cmd
    ParentImage|contains:
      - '\\Users\\'
  condition: selection and not filter
falsepositives:
  - Analysts automating workflows with scripts
level: medium

// Hunt for Wireshark crashes in the last 24 hours
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ActionType == "ProcessCrash" or ActionType == "ApplicationHang"
| where FolderPath endswith @"\wireshark.exe"
| project Timestamp, DeviceName, InitiatingProcessAccountName, AdditionalFields
| extend CrashDetails = parse_(AdditionalFields)
| order by Timestamp desc

// Hunt for Wireshark launched by suspicious automation tools
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName == "wireshark.exe"
| where InitiatingProcessFileName in ("python.exe", "wscript.exe", "powershell.exe", "cmd.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine
| order by Timestamp desc

-- Hunt for Wireshark process crashes and check versions
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'wireshark'

-- Check installed Wireshark version on Linux/Unix endpoints
SELECT Fqdn, OS, FullPath, Version
FROM glob(globs='/*/*/wireshark')
SELECT * FROM execve(argv=["wireshark", "--version"])

# PowerShell Script to Check and Update Wireshark Version (CVE-2024-6129)
# Requires Administrator Privileges

Write-Host "Checking Wireshark Version for CVE-2024-6129 Vulnerability..." -ForegroundColor Cyan

# Define common installation paths for Wireshark
$paths = @(
    "C:\Program Files\Wireshark\Wireshark.exe",
    "C:\Program Files (x86)\Wireshark\Wireshark.exe",
    "${env:ProgramFiles}\Wireshark\Wireshark.exe",
    "${env:ProgramFiles(x86)}\Wireshark\Wireshark.exe"
)

$vulnerableFound = $false

foreach ($path in $paths) {
    if (Test-Path $path) {
        $fileInfo = Get-Item $path
        $versionInfo = $fileInfo.VersionInfo.FileVersion
        Write-Host "Found Wireshark at: $path" -ForegroundColor Yellow
        Write-Host "Current Version: $versionInfo" -ForegroundColor White

        # Parse version to compare against 4.6.6.0
        # Note: Simple string comparison works for standard Wireshark versioning format X.Y.Z.Z
        if ([version]$versionInfo -lt [version]"4.6.6.0") {
            Write-Host "[ALERT] Vulnerable version detected! Update to 4.6.6 or higher immediately." -ForegroundColor Red
            $vulnerableFound = $true
        } else {
            Write-Host "[OK] Version is patched." -ForegroundColor Green
        }
    }
}

if (-not $vulnerableFound -and $paths | Where-Object { Test-Path $_ }) {
    Write-Host "No vulnerable instances found on this machine." -ForegroundColor Green
} elseif (-not ($paths | Where-Object { Test-Path $_ })) {
    Write-Host "Wireshark not found in standard paths." -ForegroundColor Gray
}

# Bash equivalent for Linux analysts can be run via: wireshark --version | head -n 1