CVE-2009-2559: Buffer overflow in the IPMI dissector in Wireshark 1.2.0 allows remote attackers to cause a denial of servi...

Security readout for executives and security teams

CVE-2009-2559 is a crash vulnerability in Wireshark 1.2.0. A malicious or malformed IPMI packet or capture could trigger a buffer overflow in the IPMI dissector, causing Wireshark to stop running. The available bundle supports denial of service only, not data theft, code execution, or active exploitation. Exposure is most plausible where Wireshark 1.2.0 is still installed and used to inspect IPMI traffic or untrusted packet captures. Modern environments are less likely to be exposed unless old analysis workstations, forensic images, lab systems, or legacy tool bundles remain in use. Treat this as a legacy exposure cleanup item unless Wireshark 1.2.0 is still used in operations, incident response, or labs. It is not supported by the bundle as actively exploited, but a crash during analysis can disrupt investigations or monitoring workflows. Mitigation focus: Inventory systems for Wireshark 1.2.0 or bundled legacy copies.; Review the Wireshark advisory for vendor-confirmed fixed versions or workarounds.; Upgrade Wireshark according to current vendor guidance..

Prepared

Jun 28, 2026, 10:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.