Software Update: Wireshark 2.6.2

Version 2.6.2 of the open source protocol analyzer and packet niffer Wireshark has been released. With this program, various data packets and network protocols on the network can be analyzed. The program can also use previously saved data traffic as input. Wireshark runs on Windows, Linux, and macOS, with separate downloads for 32bit and 64bit versions of the operating systems. The following changes and improvements have been made in this release:

The following vulnerabilities have been fixed:

• wnpa-sec-2018-34: BGP dissector large loop. Bug 13741. CVE-2018-14342.
• wnpa-sec-2018-35: ISMP dissector crash. Bug 14672. CVE-2018-14344.
• wnpa-sec-2018-36: Multiple dissectors could crash. Bug 14675. CVE-2018-14340.
• wnpa-sec-2018-37: ASN.1 BER dissector crash. Bug 14682. CVE-2018-14343.
• wnpa-sec-2018-38: MMSE dissector infinite loop. Bug 14738. CVE-2018-14339.
• wnpa-sec-2018-39: DICOM dissector crash. Bug 14742. CVE-2018-14341.
• wnpa-sec-2018-40: Bazaar dissector infinite loop. Bug 14841. CVE-2018-14368.
• wnpa-sec-2018-41: HTTP2 dissector crash. Bug 14869. CVE-2018-14369.
• wnpa-sec-2018-42: CoAP dissector crash. Bug 14966. CVE-2018-14367.

The following bugs have been fixed:

• ISMP.EDP “Tuples” dissected incorrectly. Bug 4943.
• Wireshark – Race issue when switching between files using Wireshark’s “Files in Set” dialog. Bug 10870.
• Sorting on “Source port” or “Destination port” column sorts alphabetically
• not numerically. Bug 11460.
• Wireshark crashes when changing profiles. Bug 11648.
• Crash when starting capture while saving capture file or rescanning file after display filter change. Bug 13594.
• Crash when switching to TRANSUM enabled profile. Bug 13697.
• TCP retransmission with additional payload leads to incorrect bytes and length in stream. Bug 13700.
• Wireshark crashes with single quote string display filter. Bug 14084.
• randpkt can write packets that libwiretap can’t read. Bug 14107.
• Wireshark crashes when loading new file before previous load has finished. Bug 14351.
• Valid packet produces Malformed Packet: OpcUa. Bug 14465.
• Error received from dissect_wccp2_hash_assignment_info(). Bug 14573.
• CRC checker wrong for FPP. Bug 14610.
• Cross-build broken due to make-dissectors and make-taps. Bug 14622.
• Extraction of SMB file results in wrong size. Bug 14662.
• 6LoWPAN dissector merges fragments from different sources. Bug 14700.
• IP address to name resolution doesn’t work in TShark. Bug 14711.
• “Decode as” Modbus RTU over USB doesn’t work with 2.6.0 but with 2.4.6. Bug 14717.
• proto_tree_add_protocol_format might leak memory. Bug 14719.
• tostring for NSTime objects in lua gives wrong results. Bug 14720.
• Media type “application/octet-stream” registered for both Thread and UASIP. Bug 14729.
• Crash related to SCTP tap. Bug 14733.
• Formatting of OSI area addresses/address prefixes goes past the end of the area address/address prefix. Bug 14744.
• ICMPv6 Router Renumbering – Packet Dissector – malformed. Bug 14755.
• WiMAX HARQ MAP decoder segfaults when length is too short. Bug 14780.
• HTTP PUT request following a HEAD request is not correctly decoded. Bug 14793.
• SYNC PDU type 3 miss the last PDU length. Bug 14823.
• Reversed 128 bit service UUIDs when Bluetooth Low Energy advertisement data are dissected. Bug 14843.
• Issues with Wireshark when the user doesn’t have permission to capture. Bug 14847.
• Wrong description when LE Bluetooth Device Address type is dissected. Bug 14866.
• LE Role advertisement type (0x1c) is not dissected properly according to the Bluetooth specification. Bug 14868.
• Regression: Wireshark 2.6.0 and 2.6.1 are unable to read NetMon files which were readable by previous versions. Bug 14876.
• Wireshark doesn’t properly display (deliberately) invalid 220 responses from Postfix. Bug 14878.
• Follow TCP Stream and click reassembled content moves you to incorrect current packet. Bug 14898.
• Crash when changing profiles while loading a capture file. Bug 14918.
• Duplicate PDU during C Arrays Output Export. Bug 14933.
• DCE/RPC not dissected when “reserved for use by implementations” flag bits set. Bug 14942.
• Follow TCP Stream truncates output on missing (but ACKed) segments. Bug 14944.
• There’s no option to include column headings when printing packets or exporting packet dissections with Qt Wireshark. Bug 14945.
• Qt: SCTP Graph Dialog: Abort when doing analysis. Bug 14971.
• CMake is unable to find LUA libraries. Bug 14983.

Updated Protocol Support

• 6LoWPAN
• ASN.1 BER
• bazaar
• BGP
• Bluetooth
• Bluetooth HCI_CMD
• CIGIA
• Cisco tag
• CoAP
• Dates
• DCERPC
• Diameter 3GPP
• DICOM
• DOCSIS
• FPP
• GSM A GM
• GTPv2
• HTTP
• HTTP2
• IAX2
• ICMPv6
• IEEE 1722
• IEEE 802.11
• IPv4
• ISMP
• LISP
• MMSE
• MTP3
• MySQL
• NFS
• OpcUa
• PPI GPS
• Q.931
• RNSAP
• RPCoRDMA
• S1AP
• SCTP
• SMB
• SMTP
• STUN
• SYNC
• T.30
• TCP
• TRANSUM
• WAP
• WCCP
• Wi-SUN
• WiMax HARQ Map Message
• WSP New and Updated Capture File Support
  • Alcatel-Lucent Ascend
  • Microsoft Network Monitor

The following downloads are available:
Wireshark 2.6.2 for Windows (32bit)
Wireshark 2.6.2 for Windows (64 bit)
Wireshark 2.6.2 for PortableApps
Wireshark 2.6.2 for macOS 10.6 and above (64bit)
Wireshark 2.6.2 source code for Linux, Solaris and *BSD among others