lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <200607191536.k6JFa0bs016017@lambchop.rdu.rpath.com>
Date: Wed, 19 Jul 2006 11:36:00 -0400
From: "Justin M. Forbes" <jmforbes@...th.com>
To: security-announce@...ts.rpath.com, update-announce@...ts.rpath.com
Cc: lwn@....net, full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: rPSA-2006-0132-1 tshark wireshark

rPath Security Advisory: 2006-0132-1
Published: 2006-07-19
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:
    Remote Root Deterministic Unauthorized Access
Updated Versions:
    wireshark=/conary.rpath.com@rpl:devel//1/0.99.2-2.2-1
    tshark=/conary.rpath.com@rpl:devel//1/0.99.2-2.2-1

References:
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3627
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3628
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3629
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3630
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3631
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3632
    http://www.wireshark.org/security/wnpa-sec-2006-01.html

Description:
    All versions of the ethereal and tethereal packages contain
    vulnerabilities in packet dissector modules, which may allow various
    attacks including subverting the user who is running ethereal.
    Since ethereal is generally run as root to view network traffic
    directly, this may allow complete access to the vulnerable system.
    
    The fixes are available only as part of the wireshark package.
    Development of the ethereal program has ceased under the ethereal
    name and continued under the wireshark name, due to restrictions
    on the use of the "ethereal" trademark.  The latest version of the
    ethereal and tethereal packages in rPath Linux 1 are now redirects
    to the wireshark and tshark packages.  The command "conary update
    ethereal tethereal" will cause the ethereal and tethereal packages
    on the system to be replaced by wireshark and tshark, respectively.
    The "conary updateall" command will also appropriately migrate the
    system from ethereal to wireshark.
    
    The fix for this vulnerability is available in the wireshark and
    tshark packages.  rPath strongly recommends that you update to
    the wireshark and/or tshark packages, and that you not use the
    affected ethereal and tethereal packages, particularly not on
    untrusted networks or trace files.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ