Synopsis

Moderate: wireshark security update

Type/Severity

Security Advisory: Moderate

Topic

New Wireshark packages that fix various security vulnerabilities are now
available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

Wireshark is a program for monitoring network traffic.

Several flaws were found in Wireshark's HTTP, WBXML, LDAP, and XOT protocol
dissectors. Wireshark could crash or stop responding if it read a malformed
packet off the network. (CVE-2006-4805, CVE-2006-5468, CVE-2006-5469,
CVE-2006-5740)

A single NULL byte heap based buffer overflow was found in Wireshark's MIME
Multipart dissector. Wireshark could crash or possibly execute arbitrary
arbitrary code as the user running Wireshark. (CVE-2006-4574)

Users of Wireshark should upgrade to these updated packages containing
Wireshark version 0.99.4, which is not vulnerable to these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Server 2 ia64
• Red Hat Enterprise Linux Server 2 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Workstation 2 ia64
• Red Hat Enterprise Linux Workstation 2 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 211993 - CVE-2006-4574 Multiple Wireshark issues (CVE-2006-4805, CVE-2006-5468, CVE-2006-5469, CVE-2006-5740)

CVEs

• CVE-2006-4574
• CVE-2006-5468
• CVE-2006-5469
• CVE-2006-4805
• CVE-2006-5740

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 4

SRPM
x86_64
wireshark-0.99.4-EL4.1.x86_64.rpm	SHA-256: e9e60f907ea95dc31f05e556b67c23e4f0870c80c3c10781ce8ed71f5a68c31f
wireshark-0.99.4-EL4.1.x86_64.rpm	SHA-256: e9e60f907ea95dc31f05e556b67c23e4f0870c80c3c10781ce8ed71f5a68c31f
wireshark-gnome-0.99.4-EL4.1.x86_64.rpm	SHA-256: e7bfced3dab4c11517f7dd2e6f5dd29cdf001a153111727ac1f0ce9eeca3ff3e
wireshark-gnome-0.99.4-EL4.1.x86_64.rpm	SHA-256: e7bfced3dab4c11517f7dd2e6f5dd29cdf001a153111727ac1f0ce9eeca3ff3e
ia64
wireshark-0.99.4-EL4.1.ia64.rpm	SHA-256: dd3d6aabd7b921f08139fc136b6878d71b6791342e7e751ab25419af6bdea098
wireshark-0.99.4-EL4.1.ia64.rpm	SHA-256: dd3d6aabd7b921f08139fc136b6878d71b6791342e7e751ab25419af6bdea098
wireshark-gnome-0.99.4-EL4.1.ia64.rpm	SHA-256: 77c687ad571109fa7a33057ca05012187ceb49ba88c6dee179e134e63a07c969
wireshark-gnome-0.99.4-EL4.1.ia64.rpm	SHA-256: 77c687ad571109fa7a33057ca05012187ceb49ba88c6dee179e134e63a07c969
i386
wireshark-0.99.4-EL4.1.i386.rpm	SHA-256: 9ea36b6e5004a96bf42073a42d09f17f138c93c5a1f0dabf097748e07d99909e
wireshark-0.99.4-EL4.1.i386.rpm	SHA-256: 9ea36b6e5004a96bf42073a42d09f17f138c93c5a1f0dabf097748e07d99909e
wireshark-gnome-0.99.4-EL4.1.i386.rpm	SHA-256: f881e86a55440bf1b93eb6592007a078d3b834e7e6f1377f8aea8f8eeaca3078
wireshark-gnome-0.99.4-EL4.1.i386.rpm	SHA-256: f881e86a55440bf1b93eb6592007a078d3b834e7e6f1377f8aea8f8eeaca3078

Red Hat Enterprise Linux Workstation 4

SRPM
x86_64
wireshark-0.99.4-EL4.1.x86_64.rpm	SHA-256: e9e60f907ea95dc31f05e556b67c23e4f0870c80c3c10781ce8ed71f5a68c31f
wireshark-gnome-0.99.4-EL4.1.x86_64.rpm	SHA-256: e7bfced3dab4c11517f7dd2e6f5dd29cdf001a153111727ac1f0ce9eeca3ff3e
ia64
wireshark-0.99.4-EL4.1.ia64.rpm	SHA-256: dd3d6aabd7b921f08139fc136b6878d71b6791342e7e751ab25419af6bdea098
wireshark-gnome-0.99.4-EL4.1.ia64.rpm	SHA-256: 77c687ad571109fa7a33057ca05012187ceb49ba88c6dee179e134e63a07c969
i386
wireshark-0.99.4-EL4.1.i386.rpm	SHA-256: 9ea36b6e5004a96bf42073a42d09f17f138c93c5a1f0dabf097748e07d99909e
wireshark-gnome-0.99.4-EL4.1.i386.rpm	SHA-256: f881e86a55440bf1b93eb6592007a078d3b834e7e6f1377f8aea8f8eeaca3078

Red Hat Enterprise Linux Desktop 4

SRPM
x86_64
wireshark-0.99.4-EL4.1.x86_64.rpm	SHA-256: e9e60f907ea95dc31f05e556b67c23e4f0870c80c3c10781ce8ed71f5a68c31f
wireshark-gnome-0.99.4-EL4.1.x86_64.rpm	SHA-256: e7bfced3dab4c11517f7dd2e6f5dd29cdf001a153111727ac1f0ce9eeca3ff3e
i386
wireshark-0.99.4-EL4.1.i386.rpm	SHA-256: 9ea36b6e5004a96bf42073a42d09f17f138c93c5a1f0dabf097748e07d99909e
wireshark-gnome-0.99.4-EL4.1.i386.rpm	SHA-256: f881e86a55440bf1b93eb6592007a078d3b834e7e6f1377f8aea8f8eeaca3078

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
wireshark-0.99.4-EL4.1.s390x.rpm	SHA-256: c628c9f78218f25952f2ca510fb403eaf7e246cde9ab1db70b55af4b1b5e26ef
wireshark-gnome-0.99.4-EL4.1.s390x.rpm	SHA-256: a8c1b4bb95f131f896aadc928c91a9e1823685355f468942651cc88adc88f258
s390
wireshark-0.99.4-EL4.1.s390.rpm	SHA-256: 5afd4ce36e9c377d917af6ef6cfb2d9f1712ae8e4356bfb9713c28d8f6354b3a
wireshark-gnome-0.99.4-EL4.1.s390.rpm	SHA-256: 9e60a3f067da6a40f50d0b5aa60dcf23baba42618882816c134bb17d304f99ac

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
wireshark-0.99.4-EL4.1.ppc.rpm	SHA-256: 2a1f87c7d15e4103aa00e59483f6ade582dde2a90cdd6bbc02fb3958ba920889
wireshark-gnome-0.99.4-EL4.1.ppc.rpm	SHA-256: 91c9e4f10fd017d6a720e733bcf5022931db39131a5eb90b996f9f4584e69f52