===================================================================== CERT-Renater Note d'Information No. 2011/VULN224 _____________________________________________________________________ DATE : 14/03/2011 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Fedora version 13, 14 running wireshark versions prior 1.2.15-1.fc13, 1.4.4-1.fc14. ====================================================================== http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055664.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055650.html ______________________________________________________________________ -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2011-2620 2011-03-04 09:41:39 -------------------------------------------------------------------------------- Name : wireshark Product : Fedora 13 Version : 1.2.15 Release : 1.fc13 URL : http://www.wireshark.org/ Summary : Network traffic analyzer Description : Wireshark is a network traffic analyzer for Unix-ish operating systems. This package lays base for libpcap, a packet capture and filtering library, contains command-line utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged separately to GTK+ package. -------------------------------------------------------------------------------- Update Information: Several security bugs were fixed in this release: * CVE-2011-0538: memory corruption when reading a malformed pcap file * CVE-2010-3445: stack overflow in BER dissector * CVE-2011-1143: Null pointer dereference causing application crash when reading malformed pcap file * CVE-2011-1140: Multiple stack consumption vulnerabilities caused DoS via crafted SMB or CLDAP packet * CVE-2011-1141: Malformed LDAP filter string causes Denial of Service via excessive memory consumption * CVE-2011-1138: Off-by-one error in the dissect_6lowpan_iphc function causes application crash (Denial Of Service) * CVE-2011-1139: Denial Of Service (application crash) via a pcap-ng file that contains a large packet-length field * CVE-2011-0713: heap-based buffer overflow when reading malformed Nokia DCT3 phone signalling traces -------------------------------------------------------------------------------- ChangeLog: * Thu Mar 3 2011 Jan Safranek - 1.2.15-1 - upgrade to 1.2.15 - see http://www.wireshark.org/docs/relnotes/wireshark-1.2.15.html * Mon Jan 17 2011 Jan Safranek - 1.2.14-1 - upgrade to 1.2.14 - see http://www.wireshark.org/docs/relnotes/wireshark-1.2.14.html * Wed Jan 5 2011 Jan Safranek - 1.2.13-2 - fixed buffer overflow in ENTTEC dissector (#666897) * Mon Nov 22 2010 Jan Safranek - 1.2.13-1 - upgrade to 1.2.13 - see http://www.wireshark.org/docs/relnotes/wireshark-1.2.13.html * Mon Sep 13 2010 Jan Safranek - 1.2.11-1 - upgrade to 1.2.11 - see http://www.wireshark.org/docs/relnotes/wireshark-1.2.11.html - Resolves: #632539 * Tue Aug 24 2010 Jan Safranek - 1.2.10-1 - upgrade to 1.2.10 - see http://www.wireshark.org/docs/relnotes/wireshark-1.2.10.html - Resolves: #625940 CVE-2010-2287 CVE-2010-2286 CVE-2010-2284 CVE-2010-2283 * Mon May 17 2010 Radek Vokal - 1.2.8-3 - removing traling bracket from python_sitearch (#592391) * Fri May 7 2010 Radek Vokal - 1.2.8-2 - add libtool patch * Fri May 7 2010 Radek Vokal - 1.2.8-1 - use sitearch instead of sitelib to avoid pyo and pyc conflicts - upgrade to 1.2.8 - see http://www.wireshark.org/docs/relnotes/wireshark-1.2.8.html - rebuild with GeoIP support (needs to be turned on in IP protocol preferences) - bring back -pie -------------------------------------------------------------------------------- References: [ 1 ] Bug #676232 - CVE-2011-0538 Wireshark: memory corruption when reading a malformed pcap file (upstream bug #5652) https://bugzilla.redhat.com/show_bug.cgi?id=676232 [ 2 ] Bug #678198 - CVE-2011-0713 Wireshark: heap-based buffer overflow when reading malformed Nokia DCT3 phone signalling traces https://bugzilla.redhat.com/show_bug.cgi?id=678198 [ 3 ] Bug #639486 - CVE-2010-3445 wireshark: stack overflow in BER dissector https://bugzilla.redhat.com/show_bug.cgi?id=639486 [ 4 ] Bug #681760 - CVE-2011-1143 Wireshark: Null pointer dereference causing application crash when reading malformed pcap file https://bugzilla.redhat.com/show_bug.cgi?id=681760 [ 5 ] Bug #681754 - CVE-2011-1140 Wireshark: Multiple stack consumption vulnerabilities caused DoS via crafted SMB or CLDAP packet https://bugzilla.redhat.com/show_bug.cgi?id=681754 [ 6 ] Bug #681753 - CVE-2011-1138 Wireshark: Off-by-one error in the dissect_6lowpan_iphc function causes application crash (Denial Of Service) https://bugzilla.redhat.com/show_bug.cgi?id=681753 [ 7 ] Bug #681748 - CVE-2011-1139 Wireshark: Denial Of Service (application crash) via a pcap-ng file that contains a large packet-length field https://bugzilla.redhat.com/show_bug.cgi?id=681748 [ 8 ] Bug #681756 - CVE-2011-1141 Wireshark: Malformed LDAP filter string causes Denial of Service via excessive memory consumption https://bugzilla.redhat.com/show_bug.cgi?id=681756 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update wireshark' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _________________________________________________________________________________ -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2011-2632 2011-03-04 09:42:09 -------------------------------------------------------------------------------- Name : wireshark Product : Fedora 14 Version : 1.4.4 Release : 1.fc14 URL : http://www.wireshark.org/ Summary : Network traffic analyzer Description : Wireshark is a network traffic analyzer for Unix-ish operating systems. This package lays base for libpcap, a packet capture and filtering library, contains command-line utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged separately to GTK+ package. -------------------------------------------------------------------------------- Update Information: Several security bugs were fixed in this release: * CVE-2011-0538: memory corruption when reading a malformed pcap file * CVE-2010-3445: stack overflow in BER dissector * CVE-2011-1143: Null pointer dereference causing application crash when reading malformed pcap file * CVE-2011-1140: Multiple stack consumption vulnerabilities caused DoS via crafted SMB or CLDAP packet * CVE-2011-1141: Malformed LDAP filter string causes Denial of Service via excessive memory consumption * CVE-2011-1138: Off-by-one error in the dissect_6lowpan_iphc function causes application crash (Denial Of Service) * CVE-2011-1139: Denial Of Service (application crash) via a pcap-ng file that contains a large packet-length field * CVE-2011-0713: heap-based buffer overflow when reading malformed Nokia DCT3 phone signalling traces -------------------------------------------------------------------------------- ChangeLog: * Thu Mar 3 2011 Jan Safranek - upgrade to 1.4.4 - see http://www.wireshark.org/docs/relnotes/wireshark-1.4.4.html * Mon Jan 17 2011 Jan Safranek - 1.4.2-3 - upgrade to 1.4.3 - see http://www.wireshark.org/docs/relnotes/wireshark-1.4.3.html * Wed Jan 5 2011 Jan Safranek - 1.4.2-2 - fixed buffer overflow in ENTTEC dissector (#666897) * Mon Nov 22 2010 Jan Safranek - 1.4.2-1 - upgrade to 1.4.2 - see http://www.wireshark.org/docs/relnotes/wireshark-1.4.2.html * Mon Nov 1 2010 Jan Safranek - 1.4.1-2 - temporarily disable zlib until https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4955 is resolved (#643461) * Fri Oct 22 2010 Jan Safranek - 1.4.1-1 - upgrade to 1.4.1 - see http://www.wireshark.org/docs/relnotes/wireshark-1.4.1.html - Own the %{_libdir}/wireshark dir (#644508) - associate *.pcap files with wireshark (#641163) * Tue Oct 5 2010 jkeating - 1.4.0-2.1 - Rebuilt for gcc bug 634757 -------------------------------------------------------------------------------- References: [ 1 ] Bug #676232 - CVE-2011-0538 Wireshark: memory corruption when reading a malformed pcap file (upstream bug #5652) https://bugzilla.redhat.com/show_bug.cgi?id=676232 [ 2 ] Bug #678198 - CVE-2011-0713 Wireshark: heap-based buffer overflow when reading malformed Nokia DCT3 phone signalling traces https://bugzilla.redhat.com/show_bug.cgi?id=678198 [ 3 ] Bug #639486 - CVE-2010-3445 wireshark: stack overflow in BER dissector https://bugzilla.redhat.com/show_bug.cgi?id=639486 [ 4 ] Bug #681760 - CVE-2011-1143 Wireshark: Null pointer dereference causing application crash when reading malformed pcap file https://bugzilla.redhat.com/show_bug.cgi?id=681760 [ 5 ] Bug #681754 - CVE-2011-1140 Wireshark: Multiple stack consumption vulnerabilities caused DoS via crafted SMB or CLDAP packet https://bugzilla.redhat.com/show_bug.cgi?id=681754 [ 6 ] Bug #681753 - CVE-2011-1138 Wireshark: Off-by-one error in the dissect_6lowpan_iphc function causes application crash (Denial Of Service) https://bugzilla.redhat.com/show_bug.cgi?id=681753 [ 7 ] Bug #681748 - CVE-2011-1139 Wireshark: Denial Of Service (application crash) via a pcap-ng file that contains a large packet-length field https://bugzilla.redhat.com/show_bug.cgi?id=681748 [ 8 ] Bug #681756 - CVE-2011-1141 Wireshark: Malformed LDAP filter string causes Denial of Service via excessive memory consumption https://bugzilla.redhat.com/show_bug.cgi?id=681756 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update wireshark' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23 - 25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================