--------------------------------------------------------------------- Fedora Legacy Test Update Notification FEDORALEGACY-2005-2453 Bugzilla https://bugzilla.fedora.us/show_bug.cgi?id=2453 2005-03-24 ---------------------------------------------------------------------
Name : ethereal Versions : rh7.3: ethereal-0.10.10-0.73.1.legacy Versions : rh9: ethereal-0.10.10-0.90.1.legacy Versions : fc1: ethereal-0.10.10-1.FC1.1.legacy Summary : Network traffic analyzer. Description : Ethereal is a network traffic analyzer for Unix-ish operating systems.
--------------------------------------------------------------------- Update Information:
Updated Ethereal packages that fix various security vulnerabilities are now available.
Ethereal is a program for monitoring network traffic.
A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws and cause Ethereal to crash or potentially execute arbitrary code.
A flaw in the DICOM dissector could cause a crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1139 to this issue.
A invalid RTP timestamp could hang Ethereal and create a large temporary file, possibly filling available disk space. (CAN-2004-1140)
The HTTP dissector could access previously-freed memory, causing a crash. (CAN-2004-1141)
An improperly formatted SMB packet could make Ethereal hang, maximizing CPU utilization. (CAN-2004-1142)
The COPS dissector could go into an infinite loop. (CAN-2005-0006)
The DLSw dissector could cause an assertion, making Ethereal exit prematurely. (CAN-2005-0007)
The DNP dissector could cause memory corruption. (CAN-2005-0008)
The Gnutella dissector could cause an assertion, making Ethereal exit prematurely. (CAN-2005-0009)
The MMSE dissector could free static memory, causing a crash. (CAN-2005-0010)
The X11 protocol dissector is vulnerable to a string buffer overflow. (CAN-2005-0084)
A buffer overflow flaw was discovered in the Etheric dissector. (CAN-2005-0704)
The GPRS-LLC dissector could crash if the "ignore cipher bit" option was set. (CAN-2005-0705)
A buffer overflow flaw was discovered in the 3GPP2 A11 dissector. (CAN-2005-0699)
A buffer overflow flaw was discovered in the IAPP dissector. (CAN-2005-0739)
Users of Ethereal should upgrade to these updated packages which contain version 0.10.10 and are not vulnerable to these issues.
--------------------------------------------------------------------- Changelogs
rh73:
* Mon Mar 14 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 0.10.10-0.73.1.legacy
- Updated to 0.10.10 to fix multiple security issues (FL#2453)
* Wed Feb 23 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 0.10.9-0.73.2.legacy
- Added the evil plugins hack to get plugins built
* Mon Feb 07 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 0.10.9-0.73.1.legacy
- Updated to 0.10.9 to fix multiple security issues (FL#2407)
- Modified configure parameters
- Added gcc patch
rh9:
* Mon Mar 14 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 0.10.10-0.90.1.legacy
- Updated to 0.10.10 to fix multiple security issues (FL#2453)
* Wed Feb 23 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 0.10.9-0.90.2.legacy
- Added the evil plugins hack to get plugins built
* Tue Feb 08 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 0.10.9-0.90.1.legacy
- Updated to 0.10.9 to fix multiple security issues (FL#2407)
- Modified configure parameters
fc1:
* Mon Mar 14 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 0.10.10-1.FC1.1.legacy
- Updated to 0.10.10 to fix multiple security issues (FL#2453)
* Wed Feb 23 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 0.10.9-1.FC1.2.legacy
- Added the evil plugins hack to get plugins built
* Tue Feb 08 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 0.10.9-1.FC1.1.legacy
- Updated to 0.10.9 to fix multiple security issues (FL#2407)
- Added htmlview patch
- Changed BuildRequires to gtk2
--------------------------------------------------------------------- This update can be downloaded from: http://download.fedoralegacy.org/ (sha1sums)
rh7.3:
a17bbe32f066b6962f507321ea02a966fe152d4d redhat/7.3/updates-testing/i386/ethereal-0.10.10-0.73.1.legacy.i386.rpm
70128930bb30e61b043258dd3939cbeeebd25ee6 redhat/7.3/updates-testing/i386/ethereal-gnome-0.10.10-0.73.1.legacy.i386.rpm
46f6193741ab1ad2a0c14da0e72459c2629ee2d0 redhat/7.3/updates-testing/SRPMS/ethereal-0.10.10-0.73.1.legacy.src.rpm
rh9:
3a8adb662fcf8513dd558c637271a62502558db7 redhat/9/updates-testing/i386/ethereal-0.10.10-0.90.1.legacy.i386.rpm
c99bc9df7a9e872bb423791b762d43050091238a redhat/9/updates-testing/i386/ethereal-gnome-0.10.10-0.90.1.legacy.i386.rpm
4021715cae9e9a51ef3df402572c60b81ce10702 redhat/9/updates-testing/SRPMS/ethereal-0.10.10-0.90.1.legacy.src.rpm
fc1:
bfa066398f37ed6b363218b79bcd6b23d3ddb7a1 fedora/1/updates-testing/i386/ethereal-0.10.10-1.FC1.1.legacy.i386.rpm
10a18378d280efe1b640a5732bd96621047989f2 fedora/1/updates-testing/i386/ethereal-gnome-0.10.10-1.FC1.1.legacy.i386.rpm
4f7aeac0d63296ebb49a0e83d36a5d985c8c21f9 fedora/1/updates-testing/SRPMS/ethereal-0.10.10-1.FC1.1.legacy.src.rpm
---------------------------------------------------------------------
Please test and comment in bugzilla.
Attachment:
signature.asc
Description: OpenPGP digital signature
-- fedora-legacy-list@xxxxxxxxxx http://www.redhat.com/mailman/listinfo/fedora-legacy-list
