[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] CVE Request -- wireshark
From:       Pinar Yanardag <pinar () pardus ! org ! tr>
Date:       2008-11-25 8:44:49
Message-ID: 492BBB01.1010200 () pardus ! org ! tr
[Download RAW message or body]

On 11/24/2008 11:46 AM Jan Lieskovsky wrote:
> Hello Steve,
> 
> the following remotely exploitable vulnerability in Wireshark's
> SMTP dissector has been reported:
> 
> References:
> http://packetstormsecurity.org/0811-advisories/wireshark104-dos.txt
> http://bugs.gentoo.org/show_bug.cgi?id=248425
> https://bugzilla.redhat.com/show_bug.cgi?id=472737
> http://www.nabble.com/-SVRT-04-08--Vulnerability-in-WireShark-1.0.4-for-DoS-Attack-td20640164.html
>  http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2008-11/msg00166.html
> 
> Proposed upstream patches:
> http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-smtp.c?r1=24989&r2=24988&pathrev=24989&view=patch
>  http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-smtp.c?r1=24994&r2=24993&pathrev=24994&view=patch
>  

They also updated the fix in the prerelease [1] Wireshark 1.0.5 [2].

[1]: http://www.wireshark.org/download/prerelease
[2]: 
http://www.wireshark.org/download/prerelease/wireshark-1.0.5pre1-26829.tar.gz

Cheers,

-- 
Pinar Yanardag (a.k.a PINguAR)
http://pinguar.org
_____________________________

Pardus Security Team
http://security.pardus.org.tr


[prev in list] [next in list] [prev in thread] [next in thread]