[ MDVSA-2008:242 ] wireshark
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2008:242
http://www.mandriva.com/security/
_______________________________________________________________________
Package : wireshark
Date : December 15, 2008
Affected: 2008.1, 2009.0, Corporate 4.0
_______________________________________________________________________
Problem Description:
Two vulnerabilities were discovered in Wireshark. The first is a
vulnerability in the SMTP dissector that could cause it to consume
excessive CPU and memory via a long SMTP request (CVE-2008-5285).
The second is an issue with the WLCCP dissector that could cause it
to go into an infinite loop.
This update also provides a patch to fix a potential freeze during
capture interface selection.
This update provides Wireshark 1.0.5, which is not vulnerable to
these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5285
http://www.wireshark.org/security/wnpa-sec-2008-07.html
https://qa.mandriva.com/44407
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.1:
ee21b90526edb3626f39512bcadd4b58
2008.1/i586/dumpcap-1.0.5-1.1mdv2008.1.i586.rpm
2788350610e69179510e744c9c6d44d3
2008.1/i586/libwireshark0-1.0.5-1.1mdv2008.1.i586.rpm
b0fae54f6280ef00b259ba4ab59ed689
2008.1/i586/libwireshark-devel-1.0.5-1.1mdv2008.1.i586.rpm
2dcef7209ecd34ec62f685b26ff5e7b8
2008.1/i586/rawshark-1.0.5-1.1mdv2008.1.i586.rpm
87242648aa437bf168495188b2b3cfe9
2008.1/i586/tshark-1.0.5-1.1mdv2008.1.i586.rpm
e064a6a10f1c3dbb2bcec6e538ff8455
2008.1/i586/wireshark-1.0.5-1.1mdv2008.1.i586.rpm
7ea0bc32d81dfc511533aaff94c9a00d
2008.1/i586/wireshark-tools-1.0.5-1.1mdv2008.1.i586.rpm
a5e238380691ec78c89e20f2ce440684
2008.1/SRPMS/wireshark-1.0.5-1.1mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
02ca24744348f47851ea6e342cbffce8
2008.1/x86_64/dumpcap-1.0.5-1.1mdv2008.1.x86_64.rpm
ac6f47a4cfc9bee7ea01f3b19cae2b06
2008.1/x86_64/lib64wireshark0-1.0.5-1.1mdv2008.1.x86_64.rpm
db0f0796eab0bf717b57075452cb814c
2008.1/x86_64/lib64wireshark-devel-1.0.5-1.1mdv2008.1.x86_64.rpm
8a3c45d8565056e8998bb238680178b5
2008.1/x86_64/rawshark-1.0.5-1.1mdv2008.1.x86_64.rpm
b704792a9d2158909f7222e5538ddf7b
2008.1/x86_64/tshark-1.0.5-1.1mdv2008.1.x86_64.rpm
def113ca9d8d5ccd69f548a7bfce3f7d
2008.1/x86_64/wireshark-1.0.5-1.1mdv2008.1.x86_64.rpm
276ce72785d2d0dd29fa55a5718c8bf5
2008.1/x86_64/wireshark-tools-1.0.5-1.1mdv2008.1.x86_64.rpm
a5e238380691ec78c89e20f2ce440684
2008.1/SRPMS/wireshark-1.0.5-1.1mdv2008.1.src.rpm
Mandriva Linux 2009.0:
c922d882d06c8b49a7bca56b332e1d67
2009.0/i586/dumpcap-1.0.5-1.1mdv2009.0.i586.rpm
03bc1a26cffda16f947efffdae20b83b
2009.0/i586/libwireshark0-1.0.5-1.1mdv2009.0.i586.rpm
13f39bdc3494afc9e9aaef7c454072aa
2009.0/i586/libwireshark-devel-1.0.5-1.1mdv2009.0.i586.rpm
ac4b388cc2e4eca6df769833d0d8a7eb
2009.0/i586/rawshark-1.0.5-1.1mdv2009.0.i586.rpm
46772afd3d84625e295c80b0e4026932
2009.0/i586/tshark-1.0.5-1.1mdv2009.0.i586.rpm
7169a8af7ca927e15a7547dff812c105
2009.0/i586/wireshark-1.0.5-1.1mdv2009.0.i586.rpm
17ccf73059d3dbb8c0f99b9bd2abc0e4
2009.0/i586/wireshark-tools-1.0.5-1.1mdv2009.0.i586.rpm
c71152c5c4bff536a11128e75dd13c92
2009.0/SRPMS/wireshark-1.0.5-1.1mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
3697148e23529dda7a5aee8e9898bce9
2009.0/x86_64/dumpcap-1.0.5-1.1mdv2009.0.x86_64.rpm
f6980f80e5519ee4624888740b29c870
2009.0/x86_64/lib64wireshark0-1.0.5-1.1mdv2009.0.x86_64.rpm
ec9e28e41989f50f338ebe625f8e9818
2009.0/x86_64/lib64wireshark-devel-1.0.5-1.1mdv2009.0.x86_64.rpm
a334536da447a497ebea8ac863ef32f0
2009.0/x86_64/rawshark-1.0.5-1.1mdv2009.0.x86_64.rpm
4ca66a0135d14400891b4fd00068bbfe
2009.0/x86_64/tshark-1.0.5-1.1mdv2009.0.x86_64.rpm
4889d93276a579e81e2b2c8a7a3effbd
2009.0/x86_64/wireshark-1.0.5-1.1mdv2009.0.x86_64.rpm
0ba76f3efc469133fffe11b3b430ee39
2009.0/x86_64/wireshark-tools-1.0.5-1.1mdv2009.0.x86_64.rpm
c71152c5c4bff536a11128e75dd13c92
2009.0/SRPMS/wireshark-1.0.5-1.1mdv2009.0.src.rpm
Corporate 4.0:
a69574cf8e157f82db7786e4ce1219ac
corporate/4.0/i586/dumpcap-1.0.5-0.1.20060mlcs4.i586.rpm
eab1454eee4ed9037d84a1aed6da9352
corporate/4.0/i586/libwireshark0-1.0.5-0.1.20060mlcs4.i586.rpm
880f0019417492c1344b5d97843347fa
corporate/4.0/i586/libwireshark-devel-1.0.5-0.1.20060mlcs4.i586.rpm
a4b0f4bb293eecc7107ae74c880d983d
corporate/4.0/i586/rawshark-1.0.5-0.1.20060mlcs4.i586.rpm
c297cfc31379f16a0723e5d73c84f94d
corporate/4.0/i586/tshark-1.0.5-0.1.20060mlcs4.i586.rpm
fa4a6b36f127efa72a95a7c159f6cbd3
corporate/4.0/i586/wireshark-1.0.5-0.1.20060mlcs4.i586.rpm
fbb18158d65ce919b6fe92d113d1483a
corporate/4.0/i586/wireshark-tools-1.0.5-0.1.20060mlcs4.i586.rpm
3c0afb7fe530a8e843c470915e729f34
corporate/4.0/SRPMS/wireshark-1.0.5-0.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
1f7dda7b50a03c874587ca67808887bf
corporate/4.0/x86_64/dumpcap-1.0.5-0.1.20060mlcs4.x86_64.rpm
c7898683617051f5db956e227002e30a
corporate/4.0/x86_64/lib64wireshark0-1.0.5-0.1.20060mlcs4.x86_64.rpm
fa1655b6a5ccb8ab06f74985d837d478
corporate/4.0/x86_64/lib64wireshark-devel-1.0.5-0.1.20060mlcs4.x86_64.rpm
bacc09bce747b5a8101d5bedb3d64ff5
corporate/4.0/x86_64/rawshark-1.0.5-0.1.20060mlcs4.x86_64.rpm
9ae5a12772778bb3c2dcaf748509e453
corporate/4.0/x86_64/tshark-1.0.5-0.1.20060mlcs4.x86_64.rpm
c565d766e1f39f9128bd1f87756d9244
corporate/4.0/x86_64/wireshark-1.0.5-0.1.20060mlcs4.x86_64.rpm
22b6db89db3856df29a1956fcf9410f5
corporate/4.0/x86_64/wireshark-tools-1.0.5-0.1.20060mlcs4.x86_64.rpm
3c0afb7fe530a8e843c470915e729f34
corporate/4.0/SRPMS/wireshark-1.0.5-0.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFJRqCGmqjQ0CJFipgRAn8uAJ0ZxlMMRXvx/hBd7O/UT8mcrfZ14wCg0xHe
53qADEgVe3Gv5Jf9EAk9JFc=
=dHjo
-----END PGP SIGNATURE-----