Bug 211993

Summary:	CVE-2006-4574 Multiple Wireshark issues (CVE-2006-4805, CVE-2006-5468, CVE-2006-5469, CVE-2006-5740)
Product:	Red Hat Enterprise Linux 4	Reporter:	Josh Bressers <bressers>
Component:	wireshark	Assignee:	Radek Vokál <rvokal>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.0	CC:	security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	source=cve,reported=20061017,impact=moderate,embargo=yes
Fixed In Version:	RHSA-2006-0726	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-11-09 19:11:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	213433

Description Josh Bressers 2006-10-24 13:37:07 UTC

Wireshark 0.99.4 will be fixing several security issues:

CVE-2006-5468
> * NULL point dereference
>   The HTTP dissector could dereference a null pointer.
>   Fixed in r19022, r19153
>   Bug IDs: 1050, 1079
>   Versions affected: 0.99.3.


CVE-2006-5469
>   The WBXML dissector could crash.
>   Fixed in r19560
>   Bug IDs: 1134
>   Versions affected: 0.10.11 to 0.99.3.


CVE-2006-5470
> * OOB memory read
>   The LDAP dissector (and possibly others) could crash.
>   Fixed in r19154
>   Bug IDs: 1079
>   Versions affected: 0.99.3.


CVE-2006-4805
> * Basic DoS (it crashes, that's it)
>   The XOT dissector could attempt to allocate a large amount of
>   memory and crash.
>   Fixed in r19365
>   Bug IDs: 1133
>   Versions affected: 0.9.8 to 0.99.3.


CVE-2006-4574
> * Single byte \0 overflow written onto the heap
>   The MIME Multipart dissector was susceptible to an off-by-one error.
>   Fixed in r19566
>   Bug IDs: 1135
>   Versions affected: 0.10.1 to 0.99.3.

Comment 1 Josh Bressers 2006-10-24 13:37:51 UTC

These issues also affect RHEL2.1 and RHEL3

Comment 2 Radek Vokál 2006-10-25 05:54:39 UTC

release is planned for Monday Oct 30.

Comment 3 Josh Bressers 2006-10-30 16:47:54 UTC

Due to a type, CVE-2006-5470 is now CVE-2006-5740.

Comment 4 Josh Bressers 2006-10-30 16:48:41 UTC

Lifting embargo

Comment 7 Red Hat Bugzilla 2006-11-09 19:11:23 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2006-0726.html