Wireshark RTSP Protocol Dissector Null Pointer Dereference Vulnerability

A null pointer dereference vulnerability has been identified in the RTSP protocol dissector of Wireshark. This issue is present in Wireshark versions 4.6.0 through 4.6.4. The vulnerability arises when the dissector processes a malformed RTSP DESCRIBE request containing a specific URI format, leading to a crash. The issue can be triggered by injecting a malformed packet or by opening a packet trace file that contains the malformed data.

Impact

Exploitation of this vulnerability causes Wireshark to crash, terminating the application unexpectedly.

Reproduction

The vulnerability can be reproduced by using TShark, Wireshark's command-line counterpart, with a capture file that contains the malformed RTSP DESCRIBE request. The file should be referenced in the command line, and the 'WIRESHARK_DEBUG_WMEM_OVERRIDE' environment variable should be set to 'simple' to enable the AddressSanitizer, which will report the crash caused by the vulnerability.

Remediation

Users are advised to upgrade to Wireshark version 4.6.5 or later.