Bug 485894 - (CVE-2009-0601) CVE-2009-0601 wireshark: denial of service (application crash) via format string specifiers in the HOME environment variable.
CVE-2009-0601 wireshark: denial of service (application crash) via format st...
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
https://bugs.wireshark.org/bugzilla/s...
public=20090206,reported=20090207,imp...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-02-17 04:56 EST by Jan Lieskovsky
Modified: 2009-02-17 11:59 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-02-17 11:59:06 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2009-02-17 04:56:17 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0601 to
the following vulnerability:

Format string vulnerability in Wireshark 0.99.8 through 1.0.5 on
non-Windows platforms allows local users to cause a denial of service
(application crash) via format string specifiers in the HOME
environment variable.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0601
http://www.wireshark.org/security/wnpa-sec-2009-01.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3150
http://www.securityfocus.com/bid/33690
http://www.frsirt.com/english/advisories/2009/0370
Comment 1 Jan Lieskovsky 2009-02-17 04:58:20 EST
This issue does NOT affect the version of the wireshark package, as shipped
with Red Hat Enterprise Linux 2.1.

This issue affects the versions of the wireshark package, as shipped
with Red Hat Enterprise Linux 3, 4, and 5.

This issue affects the versions of the wireshark package, as shipped
with Fedora releases of 9, 10 and devel.
Comment 3 Tomas Hoger 2009-02-17 11:59:06 EST
This is not a security issue.

When Wireshark is run directly (i.e. not via userhelper), the user running it has a full control over the environment variables passed to Wireshark.  Their values are not influenced by the data read from the network, of from the network communication capture file.  By setting some malicious value, user can only harm himself by causing Wireshark not to perform expected operations.

When Wireshark is run using userhelper with root privileges, user can not influence value of HOME environment variable.  Process' environment is re-set by userhelper.

Note You need to log in before you can comment on or make changes to this bug.