lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: listuser at seifried.org (Kurt Seifried)
Subject: OFFTOPIC Re: OpenLinux: Multiple vulnerabilities have reported in Ethereal 0.9.12  OFFTOPIC

OFFTOPIC

The last three were only fixed recently (like a week ago). I'm sorry but
Ethereal is not a critical package. To compromise a remote system via this
you'd have to know they run Ethereal with the vulnerable protocol dissectors
enabled, or send them a malicious packet capture to analyze. This is not a
real concern for most production systems (and based on Ethereal's extremely
poor security history admins should know better then to run it as root). I
don't blame them for holding off on an update (or simply putting it on the
back burner), it's of minor consequence to the vaste majority of users.
Vendors have finite resources, they have to allocate them appropriately, for
most this does not mean ethereal.

News at 9: Debian fixes epic4 IRC client, flaws originally fixed in May of
2003. End of world film at 11. I suppose we should castigate Debian for
placing the a huge number of users at risk via a remote flaw in it. Or maybe
not.

Kurt Seifried, kurt@...fried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/




Powered by blists - more mailing lists