full-disclosure - OFFTOPIC Re: OpenLinux: Multiple vulnerabilities have reported in Ethereal 0.9.12 OFFTOPIC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: listuser at seifried.org (Kurt Seifried)
Subject: OFFTOPIC Re: OpenLinux: Multiple vulnerabilities have reported in Ethereal 0.9.12  OFFTOPIC

OFFTOPIC

The last three were only fixed recently (like a week ago). I'm sorry but
Ethereal is not a critical package. To compromise a remote system via this
you'd have to know they run Ethereal with the vulnerable protocol dissectors
enabled, or send them a malicious packet capture to analyze. This is not a
real concern for most production systems (and based on Ethereal's extremely
poor security history admins should know better then to run it as root). I
don't blame them for holding off on an update (or simply putting it on the
back burner), it's of minor consequence to the vaste majority of users.
Vendors have finite resources, they have to allocate them appropriately, for
most this does not mean ethereal.

News at 9: Debian fixes epic4 IRC client, flaws originally fixed in May of
2003. End of world film at 11. I suppose we should castigate Debian for
placing the a huge number of users at risk via a remote flaw in it. Or maybe
not.

Kurt Seifried, kurt@...fried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/