CVE-2024-24478: 
Wireshark vulnerability analysis and mitigation

An issue in Wireshark before version 4.2.0 was reported as CVE-2024-24478, which potentially allows a remote attacker to cause a denial of service through the packet-bgp.c file, specifically in the dissect_bgp_open(tvbuff_ttvb, proto_treetree, packet_info*pinfo) function's optlen components. However, this vulnerability is disputed by the vendor, who states that neither release 4.2.0 nor any other release was affected (CVE Details).

The vulnerability was initially reported as an integer overflow issue in the BGP dissector component of Wireshark, specifically related to the handling of the extended option length in RFC 9072. The issue was addressed by storing the option length in a 16-bit integer to prevent stepping the offset by the wrong value due to overflow (GitHub Commit).

The reported vulnerability could potentially lead to a denial of service condition if successfully exploited (Gist Report).

The exploitability of this vulnerability is questionable as it has been disputed by the vendor. According to the vendor's statement, no versions of Wireshark were actually affected by this issue (CVE Details).

Since the vulnerability is disputed by the vendor and reportedly did not affect any released versions, no specific mitigation steps are required. The code changes made were preventive in nature, implementing proper integer handling for BGP option length processing (GitHub Commit).