oss-security - Re: CVE Request -- wireshark

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Tue, 25 Nov 2008 10:44:49 +0200
From: Pinar Yanardag <pinar@...dus.org.tr>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request -- wireshark

On 11/24/2008 11:46 AM Jan Lieskovsky wrote:
> Hello Steve,
>
>   the following remotely exploitable vulnerability in Wireshark's
> SMTP dissector has been reported:
>
> References:
> http://packetstormsecurity.org/0811-advisories/wireshark104-dos.txt
> http://bugs.gentoo.org/show_bug.cgi?id=248425
> https://bugzilla.redhat.com/show_bug.cgi?id=472737
> http://www.nabble.com/-SVRT-04-08--Vulnerability-in-WireShark-1.0.4-for-DoS-Attack-td20640164.html
> http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2008-11/msg00166.html
>
> Proposed upstream patches:
> http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-smtp.c?r1=24989&r2=24988&pathrev=24989&view=patch
> http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-smtp.c?r1=24994&r2=24993&pathrev=24994&view=patch
>   

They also updated the fix in the prerelease [1] Wireshark 1.0.5 [2].

[1]: http://www.wireshark.org/download/prerelease
[2]: 
http://www.wireshark.org/download/prerelease/wireshark-1.0.5pre1-26829.tar.gz

Cheers,

-- 
Pinar Yanardag (a.k.a PINguAR)
http://pinguar.org
_____________________________

Pardus Security Team
http://security.pardus.org.tr

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.