bugtraq - rPSA-2006-0158-1 tshark wireshark

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200608250415.k7P4F0Lt004356@lambchop.rdu.rpath.com>
Date: Fri, 25 Aug 2006 00:15:00 -0400
From: "Justin M. Forbes" <jmforbes@...th.com>
To: security-announce@...ts.rpath.com,
	update-announce@...ts.rpath.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	lwn@....net
Subject: rPSA-2006-0158-1 tshark wireshark

rPath Security Advisory: 2006-0158-1
Published: 2006-08-25
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:
    Remote Root Non-deterministic Vulnerability
Updated Versions:
    wireshark=/conary.rpath.com@rpl:devel//1/0.99.3a-0.1-1
    tshark=/conary.rpath.com@rpl:devel//1/0.99.3a-0.1-1

References:
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4330
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4333
    https://issues.rpath.com/browse/RPL-597
    http://www.wireshark.org/security/wnpa-sec-2006-02.html

Description:
    All versions of the ethereal and tethereal packages, as well as
    all previous versions of the wireshark and tshark packages, will
    crash and possibly execute remotely-provided code when presented
    with certain malformed packets.  Because wireshark and tshark are
    often run as the root user, this may allow complete access to the
    vulnerable system.
    
    The fixes are available only as part of the wireshark package.
    Development of the ethereal program has ceased under the ethereal
    name and continued under the wireshark name, due to restrictions
    on the use of the "ethereal" trademark.  The latest version of the
    ethereal and tethereal packages in rPath Linux 1 are now redirects
    to the wireshark and tshark packages.  The command "conary update
    ethereal tethereal" will cause the ethereal and tethereal packages
    on the system to be replaced by wireshark and tshark, respectively.
    The "conary updateall" command will also appropriately migrate the
    system from ethereal to wireshark.
    
    The fix for this vulnerability is available in the latest version of
    the wireshark and tshark packages.  rPath strongly recommends that
    you update to the wireshark and/or tshark packages, and that you
    not use the affected ethereal and tethereal packages, particularly
    not on untrusted networks or trace files.
    
    Note that vulnerabilities described in CVE-2006-4331 and
    CVE-2006-4332, which are also resolved in this version of the
    wireshark source code, do not apply to rPath Linux.