Bug 472737 (CVE-2008-5285)

Summary:	CVE-2008-5285 wireshark: DoS (infinite loop) in SMTP dissector via large SMTP request
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	kreilly, rvokal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-03-05 07:48:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	486548, 486549, 486550, 486551, 486552, 833990
Bug Blocks:

Description Jan Lieskovsky 2008-11-24 09:41:56 UTC

A security flaw was found in the Wireshark's SMTP dissector -- routines for SMTP packet disassembly. A remote attacker could use this flaw to cause a denial of service (infinite loop) via sending a large SMTP request to port 25.

References:
http://packetstormsecurity.org/0811-advisories/wireshark104-dos.txt
http://www.securityfocus.com/archive/1/498562/30/0/threaded
http://www.nabble.com/-SVRT-04-08--Vulnerability-in-WireShark-1.0.4-for-DoS-Attack-td20640164.html

Proposed upstream patches:
http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-smtp.c?r1=24989&r2=24988&pathrev=24989&view=patch
http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-smtp.c?r1=24994&r2=24993&pathrev=24994&view=patch

Comment 1 Jan Lieskovsky 2008-12-02 12:52:04 UTC

The Red Hat Security Response Team has rated this issue as having low security
impact, a future update may address this flaw. More information regarding
issue severity can be found here:

http://www.redhat.com/security/updates/classification/

Comment 4 Red Hat Product Security 2009-03-05 07:48:40 UTC

This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2009-0313.html