Fedora Legacy alert: Updated ethereal resolves security vulnerabilites

Posted by dave on Jan 31, 2004 10:40 PM EDT
Mailing list
Mail this story
Print this story

Updated ethereal packages are now available that fix multiple security vulnerabilities which may allow attackers to make Ethereal crash by injecting an intentionally malformed packet onto the wire or by convincing someone to read a malformed packet trace file. It is not known if these issues could allow arbitrary code execution.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ----------------------------------------------------------------------- Fedora Legacy Update Advisory

Synopsis: Updated ethereal resolves security vulnerabilities Advisory ID: FLSA:1193 Issue date: 2004-01-31 Product: Red Hat Linux Keywords: Security Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1193 CVE Names: CAN-2003-1012, CAN-2004-1013 - -----------------------------------------------------------------------

1. Topic:

Updated ethereal packages are now available that fix multiple security vulnerabilities which may allow attackers to make Ethereal crash by injecting an intentionally malformed packet onto the wire or by convincing someone to read a malformed packet trace file. It is not known if these issues could allow arbitrary code execution.

2. Relevant releases/architectures:

Red Hat Linux 7.2 - i386 Red Hat Linux 7.3 - i386 Red Hat Linux 8.0 - i386

3. Problem description:

Ethereal is a network traffic analyzer for Unix-ish operating systems.

The SMB dissector in Ethereal before 0.10.0 allows remote attackers to cause a denial of service via a malformed SMB packet that triggers a segmentation fault during processing of Selected packets. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-1012 to this issue.

The Q.931 dissector in Ethereal before 0.10.0 allows remote attackers to cause a denial of service (crash) via a malformed Q.931, which triggers a null dereference. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-1013 to this issue. Users of tcpdump should update to these update packages, which contain a backported security patch that corrects this issue.

Users of ethereal should update to these update packages, which contain a backported security patch that corrects this issue.

Fedora Legacy would like to thank Christian Pearce for providing a backported fix for Red Hat Linux 7.2, 7.3, and 8.0.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs.

Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/download for directions on how to configure yum and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us - 1193 - ethereal security patch in rh7x, rh8

6. RPMs required:

Red Hat Linux 7.2:

SRPMS: http://download.fedoralegacy.org/redhat/7.2/updates/SRPMS/ethereal-0.9.16-0.72.2.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.2/updates/i386/ethereal-0.9.16-0.72.2.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.2/updates/i386/ethereal-gnome-0.9.16-0.72.2.legacy.i386.rpm

Red Hat Linux 7.3:

SRPMS: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/ethereal-0.9.16-0.73.2.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/ethereal-0.9.16-0.73.2.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/ethereal-gnome-0.9.16-0.73.2.legacy.i386.rpm

Red Hat Linux 8.0:

SRPMS: http://download.fedoralegacy.org/redhat/8.0/updates/SRPMS/ethereal-0.9.16-0.80.2.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/8.0/updates/i386/ethereal-0.9.16-0.80.2.legacy.i386.rpm http://download.fedoralegacy.org/redhat/8.0/updates/i386/ethereal-gnome-0.9.16-0.80.2.legacy.i386.rpm

7. Verification:

SHA1 sum Package Name - --------------------------------------------------------------------------- 9f1a7186859a95604431f52e137943f4a256b89f 7.2/updates/SRPMS/ethereal-0.9.16-0.72.2.legacy.src.rpm 01e991b44ca40f432b639a9cdd25f46ab60a85e7 7.2/updates/i386/ethereal-0.9.16-0.72.2.legacy.i386.rpm c263966f199db31ec551d9dff07363830f575bff 7.2/updates/i386/ethereal-gnome-0.9.16-0.72.2.legacy.i386.rpm

1aebaffacc86561fea139b3dae351722eda761b9 7.3/updates/SRPMS/ethereal-0.9.16-0.73.2.legacy.src.rpm db5326236fe91e7c84be611bbfdafd689187b32b 7.3/updates/i386/ethereal-0.9.16-0.73.2.legacy.i386.rpm d78ca86ff9ca7adb7c0d006c43fe84d138bc87e0 7.3/updates/i386/ethereal-gnome-0.9.16-0.73.2.legacy.i386.rpm

14350e74f4e261002bab186c942bc6caa788fce3 8.0/updates/SRPMS/ethereal-0.9.16-0.80.2.legacy.src.rpm dc94ba568db4239f67cb191d4cf43a



  Nav
» Read more about: Story Type: Security; Groups: Fedora Legacy

« Return to the newswire homepage

This topic does not have any threads posted yet!

You cannot post until you login.