full-disclosure - rPSA-2007-0023-1 tshark wireshark

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <45c5618c.JmlzEuFlLLjYQkXK%announce-noreply@rpath.com>
Date: Sat, 03 Feb 2007 23:31:08 -0500
From: rPath Update Announcements <announce-noreply@...th.com>
To: security-announce@...ts.rpath.com, update-announce@...ts.rpath.com
Cc: lwn@....net, full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: rPSA-2007-0023-1 tshark wireshark

rPath Security Advisory: 2007-0023-1
Published: 2007-02-03
Products: rPath Linux 1
Rating: Major
Exposure Level Classification:
    Remote User Deterministic Denial of Service
Updated Versions:
    wireshark=/conary.rpath.com@rpl:devel//1/0.99.5-0.1-1
    tshark=/conary.rpath.com@rpl:devel//1/0.99.5-0.1-1

References:
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0456
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0457
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0458
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0459
    https://issues.rpath.com/browse/RPL-985

Description:
    Previous versions of the wireshark and tshark packages, and all
    versions of the ethereal and tethereal packages, are vulnerable to
    several remote Denial of Service attacks which can cause the
    application to crash while interpreting network traffic or a
    previously-recorded network traffic trace file.
    
    The fixes are available only as part of the wireshark package.
    Development of the ethereal program has ceased under the ethereal
    name and continued under the wireshark name, due to restrictions
    on the use of the "ethereal" trademark.  The latest version of the
    ethereal and tethereal packages in rPath Linux 1 are now redirects
    to the wireshark and tshark packages.  The command "conary update
    ethereal tethereal" will cause the ethereal and tethereal packages
    on the system to be replaced by wireshark and tshark, respectively.
    The "conary updateall" command will also appropriately migrate the
    system from ethereal to wireshark.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/