http://bugs.gentoo.org/show_bug.cgi?id=199958

SUSE-SR:2008:004

27777

28197

28207

28288

28304

28325

28564

29048

GLSA-200712-23

1018988

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0004

MDVSA-2008:001

MDVSA-2008:1

RHSA-2008:0058

20080103 rPSA-2008-0004-1 tshark wireshark

26532

ADV-2007-3956

http://www.wireshark.org/security/wnpa-sec-2007-03.html

https://issues.rpath.com/browse/RPL-1975

oval:org.mitre.oval:def:14561

oval:org.mitre.oval:def:9772

FEDORA-2007-4590

FEDORA-2007-4690

From Red Hat Security Advisory 2008:0058 :

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. Wireshark could crash or possibly execute arbitrary code as the user running Wireshark if it read a malformed packet off the network. (CVE-2007-6112, CVE-2007-6114, CVE-2007-6115, CVE-2007-6117)

Several denial of service bugs were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off the network. (CVE-2007-6111, CVE-2007-6113, CVE-2007-6116, CVE-2007-6118, CVE-2007-6119, CVE-2007-6120, CVE-2007-6121, CVE-2007-6438, CVE-2007-6439, CVE-2007-6441, CVE-2007-6450, CVE-2007-6451)

As well, Wireshark switched from using net-snmp to libsmi, which is included in this errata.

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 0.99.7, and resolve these issues.

Several flaws were found in Wireshark. Wireshark could crash or possibly execute arbitrary code as the user running Wireshark if it read a malformed packet off the network. (CVE-2007-6112, CVE-2007-6114, CVE-2007-6115, CVE-2007-6117)

Several denial of service bugs were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3392, CVE-2007-3393, CVE-2007-6111, CVE-2007-6113, CVE-2007-6116, CVE-2007-6118, CVE-2007-6119, CVE-2007-6120, CVE-2007-6121, CVE-2007-6438, CVE-2007-6439, CVE-2007-6441, CVE-2007-6450, CVE-2007-6451)

As well, Wireshark switched from using net-snmp to libsmi, which is included in this errata.

Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Several flaws were found in Wireshark. Wireshark could crash or possibly execute arbitrary code as the user running Wireshark if it read a malformed packet off the network. (CVE-2007-6112, CVE-2007-6114, CVE-2007-6115, CVE-2007-6117)

Several denial of service bugs were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off the network. (CVE-2007-6111, CVE-2007-6113, CVE-2007-6116, CVE-2007-6118, CVE-2007-6119, CVE-2007-6120, CVE-2007-6121, CVE-2007-6438, CVE-2007-6439, CVE-2007-6441, CVE-2007-6450, CVE-2007-6451)

As well, Wireshark switched from using net-snmp to libsmi, which is included in this errata.

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 0.99.7, and resolve these issues.

A number of vulnerabilities in the Wireshark program were found that could cause crashes, excessive looping, or arbitrary code execution.

This update provides Wireshark 0.99.7 which is not vulnerable to these issues.

An updated version of libsmi is also being provided, not because of security issues, but because this version of wireshark uses it instead of net-snmp for SNMP support.

Update :

This update is being reissued without libcap (kernel capabilities) support, as that is not required by the original released packages, and thus gave trouble for a number of users.

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6450     The RPL dissector could be tricked into an infinite     loop.

  - CVE-2007-6451     The CIP dissector could be tricked into excessive memory     allocation.

The remote host is affected by the vulnerability described in GLSA-200712-23 (Wireshark: Multiple vulnerabilities)

    Multiple buffer overflows and infinite loops were discovered in     multiple dissector and parser components, including those for MP3 and     NCP (CVE-2007-6111), PPP (CVE-2007-6112), DNP (CVE-2007-6113), SSL and     iSeries (OS/400) Communication traces (CVE-2007-6114), ANSI MAP     (CVE-2007-6115), Firebird/Interbase (CVE-2007-6116), HTTP     (CVE-2007-6117), MEGACO (CVE-2007-6118), DCP ETSI (CVE-2007-6119),     Bluetooth SDP (CVE-2007-6120), RPC Portmap (CVE-2007-6121), SMB     (CVE-2007-6438), IPv6 amd USB (CVE-2007-6439), WiMAX (CVE-2007-6441),     RPL (CVE-2007-6450), CIP (CVE-2007-6451). The vulnerabilities were     discovered by Stefan Esser, Beyond Security, Fabiodds, Peter Leeming,     Steve and ainsley.
  Impact :

    A remote attacker could send specially crafted packets on a network     being monitored with Wireshark or entice a user to open a specially     crafted file, possibly resulting in the execution of arbitrary code     with the privileges of the user running Wireshark (which might be the     root user), or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The Wireshark team reports of multiple vulnerabilities :

- Wireshark could crash when reading an MP3 file.

- Beyond Security discovered that Wireshark could loop excessively while reading a malformed DNP packet.

- Stefan Esser discovered a buffer overflow in the SSL dissector.

- The ANSI MAP dissector could be susceptible to a buffer overflow on some platforms.

- The Firebird/Interbase dissector could go into an infinite loop or crash.

- The NCP dissector could cause a crash.

- The HTTP dissector could crash on some systems while decoding chunked messages.

- The MEGACO dissector could enter a large loop and consume system resources.

- The DCP ETSI dissector could enter a large loop and consume system resources.

- Fabiodds discovered a buffer overflow in the iSeries (OS/400) Communication trace file parser.

- The PPP dissector could overflow a buffer.

- The Bluetooth SDP dissector could go into an infinite loop.

- A malformed RPC Portmap packet could cause a crash.

- The IPv6 dissector could loop excessively.

- The USB dissector could loop excessively or crash.

- The SMB dissector could crash.

- The RPL dissector could go into an infinite loop.

- The WiMAX dissector could crash due to unaligned access on some platforms.

- The CIP dissector could attempt to allocate a huge amount of memory and crash. Impact It may be possible to make Wireshark or Ethereal crash or use up available memory by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

upgrade to 0.99.7 fixes various security flaws.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Various flaws fixed by upgrade to 0.99.7

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
67642	Oracle Linux 4 / 5 : wireshark (ELSA-2008-0058)	Nessus	Oracle Linux Local Security Checks	critical
60350	Scientific Linux Security Update : wireshark on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
43670	CentOS 4 / 5 : wireshark (CESA-2008:0058)	Nessus	CentOS Local Security Checks	critical
36583	Mandriva Linux Security Advisory : wireshark (MDVSA-2008:001-1)	Nessus	Mandriva Local Security Checks	critical
30034	RHEL 4 / 5 : wireshark (RHSA-2008:0058)	Nessus	Red Hat Local Security Checks	critical
29840	Debian DSA-1446-1 : wireshark - several vulnerabilities	Nessus	Debian Local Security Checks	critical
29820	GLSA-200712-23 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
29772	FreeBSD : wireshark -- multiple vulnerabilities (8a835235-ae84-11dc-a5f9-001a4d49522b)	Nessus	FreeBSD Local Security Checks	critical
29766	Fedora 7 : wireshark-0.99.7-1.fc7 (2007-4690)	Nessus	Fedora Local Security Checks	critical
29760	Fedora 8 : wireshark-0.99.7-2.fc8 (2007-4590)	Nessus	Fedora Local Security Checks	critical

CVE-2007-6112

HIGH

Description

References

Details

Risk Information

CVSS v2.0

Vulnerable Software

Configuration 1

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical