lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
From: listuser at seifried.org (Kurt Seifried) Subject: OFFTOPIC Re: OpenLinux: Multiple vulnerabilities have reported in Ethereal 0.9.12 OFFTOPIC OFFTOPIC The last three were only fixed recently (like a week ago). I'm sorry but Ethereal is not a critical package. To compromise a remote system via this you'd have to know they run Ethereal with the vulnerable protocol dissectors enabled, or send them a malicious packet capture to analyze. This is not a real concern for most production systems (and based on Ethereal's extremely poor security history admins should know better then to run it as root). I don't blame them for holding off on an update (or simply putting it on the back burner), it's of minor consequence to the vaste majority of users. Vendors have finite resources, they have to allocate them appropriately, for most this does not mean ethereal. News at 9: Debian fixes epic4 IRC client, flaws originally fixed in May of 2003. End of world film at 11. I suppose we should castigate Debian for placing the a huge number of users at risk via a remote flaw in it. Or maybe not. Kurt Seifried, kurt@...fried.org A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://seifried.org/security/
Powered by blists - more mailing lists