An information disclosure flaw was found in the way Wireshark, a network traffic analyzer, stored name resolution information for pcap-ng (PCAP Next Generation Dump File) format files (previously resolution information was shared between different pcap-ng capture files in certain circumstances). A local user could use this deficiency to in an unauthorized way obtain host entries information, when working with multiple pcap-ng files. References: [1] http://www.wireshark.org/security/wnpa-sec-2012-30.html [2] http://www.wireshark.org/docs/relnotes/wireshark-1.8.4.html Relevant upstream patch (seems to be this one): [3] http://anonsvn.wireshark.org/viewvc?view=revision&revision=45511
This issue did NOT affect the versions of the wireshark package, as shipped with Red Hat Enterprise Linux 5 and 6. -- This issue did NOT affect the versions of the wireshark package, as shipped with Fedora release of 16 and 17.
This was assigned CVE-2012-5592: http://www.openwall.com/lists/oss-security/2012/11/29/5
Statement CVE-2012-6052: Not vulnerable. This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2012-5592 identifier has been rejected by Mitre in favour of CVE-2012-6052: Name: CVE-2012-5592 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6052. Reason: This candidate is a reservation duplicate of CVE-2012-6052. Notes: All CVE users should reference CVE-2012-6052 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. -- The correct id, this particular wireshark flaw should be referenced under (from now on) is CVE-2012-6052.