CVE-2023-6175

What it actually does

Crafted capture file triggers memory corruption in the NetScreen parser leading to application crash and denial of service.

Why it matters to the business

Interrupts network analysis and forensic workflows for organizations relying on Wireshark, causing operational delays in security investigations with no ransomware usage reported.

How an attack unfolds

An attacker crafts a malicious pcap containing malformed NetScreen data and supplies the file to a target user or automated process that opens it in an affected Wireshark version, resulting in immediate crash.

How to fix it

Upgrade wireshark/wireshark (GIT) to the commit 9313445cab119c38487ed8a22fcbfb6af2e6a7e8 or later release containing the fix; rebuild from source if using custom builds.

How to confirm the fix worked

Confirm Wireshark reports the fixed commit or version string; re-test with known crashing capture samples to verify parser no longer aborts.

Typical attack path

1. Generate pcap with malformed NetScreen records
2. Deliver file via email, download, or shared storage
3. Victim or script opens the file in vulnerable Wireshark
4. Parser processes malformed data and crashes the application

How to detect it

Review application crash logs and core dumps on analyst systems for Wireshark process terminations shortly after opening capture files; correlate with file access timestamps of suspicious pcaps.

What your security team should do

• Apply the fixed commit immediately on all analyst workstations and build pipelines
• Restrict opening of untrusted capture files until patched
• Monitor for Wireshark crash reports in centralized logging