Bug 145481 - CAN-2005-0006 multiple ethereal issues (CAN-2005-0007 CAN-2005-0008 CAN-2005-0009 CAN-2005-0010 CAN-2005-0084)
Summary: CAN-2005-0006 multiple ethereal issues (CAN-2005-0007 CAN-2005-0008 CAN-2005-...
Alias: None
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: ethereal   
(Show other bugs)
Version: 3.0
Hardware: All Linux
Target Milestone: ---
Assignee: Radek Vokal
QA Contact:
Whiteboard: impact=moderate,embargoed=20050119
Keywords: Security
Depends On:
TreeView+ depends on / blocked
Reported: 2005-01-18 21:16 UTC by Josh Bressers
Modified: 2007-11-30 22:07 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-02-02 12:07:38 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2005:011 normal SHIPPED_LIVE Moderate: ethereal security update 2005-02-02 05:00:00 UTC

Description Josh Bressers 2005-01-18 21:16:47 UTC
Gerald Combs reported multiple issues in Ethereal to vendor-sec

>Ethereal 0.10.9 is scheduled to be released tomorrow (January 18).  It
>will address the following issues:
> The COPS dissector could go into an infinite loop.
> Versions affected: 0.10.6 - 0.10.8
> Fixed in revision: 13075


> The DLSw dissector could cause an assertion, making Ethereal exit
> prematurely.
> Versions affected: 0.10.6 - 0.10.8
> Fixed in revision: 13012


> The DNP dissector could cause memory corruption.
> Versions affected: 0.10.5 - 0.10.8
> Fixed in revision: 13083


> The Gnutella dissector could cuase an assertion, making Ethereal exit
> prematurely.
> Versions affected: 0.10.6 - 0.10.8
> Fixed in revision: 13032


> The MMSE dissector could free statically-allocated memory.
> Versions affected: 0.10.4 - 0.10.8
> Fixed in revision: 12801


> The X11 dissector is vulnerable to a string buffer overflow.
> Versions affected: 0.8.10 - 0.10.8
> Fixed in revision: 13057


Comment 1 Josh Bressers 2005-01-18 21:19:04 UTC

I'm thinking we should just wait for the new ethereal version, then re-roll the
RHEL errata packages.

Comment 2 Josh Bressers 2005-01-18 21:19:44 UTC
This issue is also going to affect RHEL2.1

Comment 3 Radek Vokal 2005-01-19 08:18:36 UTC
We should ship ethereal labeled as dangerous software and only for skilled
users. Of course waiting for 0.10.9 makes sence .. 

Comment 4 Radek Vokal 2005-01-25 13:42:52 UTC
Ethereal updated to version 0.10.9

Comment 5 Mark J. Cox 2005-02-02 12:07:38 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.