Bug 881855 (CVE-2012-5592, CVE-2012-6052)
|Summary:||CVE-2012-5592 CVE-2012-6052 wireshark: pcap-ng hostname disclosure (wnpa-sec-2012-30)|
|Product:||[Other] Security Response||Reporter:||Jan Lieskovsky <jlieskov>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED NOTABUG||QA Contact:|
|Version:||unspecified||CC:||huzaifas, jrusnack, jsafrane, mapcode.mind, phatina, rvokal|
|Fixed In Version:||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2012-11-29 21:55:03 UTC||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
|Bug Depends On:|
Description Jan Lieskovsky 2012-11-29 17:12:51 UTC
An information disclosure flaw was found in the way Wireshark, a network traffic analyzer, stored name resolution information for pcap-ng (PCAP Next Generation Dump File) format files (previously resolution information was shared between different pcap-ng capture files in certain circumstances). A local user could use this deficiency to in an unauthorized way obtain host entries information, when working with multiple pcap-ng files. References:  http://www.wireshark.org/security/wnpa-sec-2012-30.html  http://www.wireshark.org/docs/relnotes/wireshark-1.8.4.html Relevant upstream patch (seems to be this one):  http://anonsvn.wireshark.org/viewvc?view=revision&revision=45511
Comment 1 Jan Lieskovsky 2012-11-29 17:20:29 UTC
This issue did NOT affect the versions of the wireshark package, as shipped with Red Hat Enterprise Linux 5 and 6. -- This issue did NOT affect the versions of the wireshark package, as shipped with Fedora release of 16 and 17.
Comment 2 Vincent Danen 2012-11-29 21:54:40 UTC
This was assigned CVE-2012-5592: http://www.openwall.com/lists/oss-security/2012/11/29/5
Comment 3 Vincent Danen 2012-11-29 22:04:27 UTC
Statement CVE-2012-6052: Not vulnerable. This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 5 and 6.
Comment 4 Jan Lieskovsky 2012-12-05 13:32:52 UTC
CVE-2012-5592 identifier has been rejected by Mitre in favour of CVE-2012-6052: Name: CVE-2012-5592 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6052. Reason: This candidate is a reservation duplicate of CVE-2012-6052. Notes: All CVE users should reference CVE-2012-6052 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. -- The correct id, this particular wireshark flaw should be referenced under (from now on) is CVE-2012-6052.