Synopsis

Low: wireshark security and bug fix update

Type/Severity

Security Advisory: Low

Topic

New Wireshark packages that fix various security vulnerabilities and
functionality bugs are now available for Red Hat Enterprise Linux 4.
Wireshark was previously known as Ethereal.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Description

Wireshark is a program for monitoring network traffic.

Several denial of service bugs were found in Wireshark's HTTP, iSeries, DCP
ETSI, SSL, MMS, DHCP and BOOTP protocol dissectors. It was possible for
Wireshark to crash or stop responding if it read a malformed packet off the
network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392,
CVE-2007-3393)

Wireshark would interpret certain completion codes incorrectly when
dissecting IPMI traffic. Additionally, IPMI 2.0 packets would be reported
as malformed IPMI traffic.

Users of Wireshark should upgrade to these updated packages containing
Wireshark version 0.99.6, which correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 245796 - CVE-2007-3389 Wireshark crashes when inspecting HTTP traffic
• BZ - 245797 - CVE-2007-3391 Wireshark loops infinitely when inspecting DCP ETSI traffic
• BZ - 245798 - CVE-2007-3392 Wireshark loops infinitely when inspecting SSL traffic
• BZ - 246221 - CVE-2007-3393 Wireshark corrupts the stack when inspecting BOOTP traffic
• BZ - 246225 - CVE-2007-3390 Wireshark crashes when inspecting iSeries traffic
• BZ - 246229 - CVE-2007-3392 Wireshark crashes when inspecting MMS traffic

CVEs

• CVE-2007-3391
• CVE-2007-3390
• CVE-2007-3393
• CVE-2007-3389
• CVE-2007-3392

References

• http://www.wireshark.org/docs/relnotes/wireshark-0.99.6.html
• http://www.redhat.com/security/updates/classification/#low

Red Hat Enterprise Linux Server 4

SRPM
wireshark-0.99.6-EL4.1.src.rpm	SHA-256: 99f2bd8ccb2056e799fe2923ba64b8479eb29c864e99f53967d659202a1a01c8
x86_64
wireshark-0.99.6-EL4.1.x86_64.rpm	SHA-256: 55fd818972855e7bf69c99e24ec52338f254fcb549f5a159c3c7959e417a2d61
wireshark-0.99.6-EL4.1.x86_64.rpm	SHA-256: 55fd818972855e7bf69c99e24ec52338f254fcb549f5a159c3c7959e417a2d61
wireshark-gnome-0.99.6-EL4.1.x86_64.rpm	SHA-256: 8f0f97f61229465b7c2c21a7507397bf651009c0e994e7eca3e395e633e45b7e
wireshark-gnome-0.99.6-EL4.1.x86_64.rpm	SHA-256: 8f0f97f61229465b7c2c21a7507397bf651009c0e994e7eca3e395e633e45b7e
ia64
wireshark-0.99.6-EL4.1.ia64.rpm	SHA-256: eda143a1d6f9e067a743b1310d91eeae8b6537810569fb6ac5339d8dc4ff2795
wireshark-0.99.6-EL4.1.ia64.rpm	SHA-256: eda143a1d6f9e067a743b1310d91eeae8b6537810569fb6ac5339d8dc4ff2795
wireshark-gnome-0.99.6-EL4.1.ia64.rpm	SHA-256: 0f51153b852e51fb83b942b9612cd99046dd9fcc88e1fb100f9beb2ffda262d4
wireshark-gnome-0.99.6-EL4.1.ia64.rpm	SHA-256: 0f51153b852e51fb83b942b9612cd99046dd9fcc88e1fb100f9beb2ffda262d4
i386
wireshark-0.99.6-EL4.1.i386.rpm	SHA-256: 7b4733082ebcf096bb0a0bd6290186c61dfcff2a413dc787874363558736838f
wireshark-0.99.6-EL4.1.i386.rpm	SHA-256: 7b4733082ebcf096bb0a0bd6290186c61dfcff2a413dc787874363558736838f
wireshark-gnome-0.99.6-EL4.1.i386.rpm	SHA-256: 7854732806781f7e40187239d20dbd790699795e530ed4e9ad7a31b702afa32c
wireshark-gnome-0.99.6-EL4.1.i386.rpm	SHA-256: 7854732806781f7e40187239d20dbd790699795e530ed4e9ad7a31b702afa32c

Red Hat Enterprise Linux Workstation 4

SRPM
wireshark-0.99.6-EL4.1.src.rpm	SHA-256: 99f2bd8ccb2056e799fe2923ba64b8479eb29c864e99f53967d659202a1a01c8
x86_64
wireshark-0.99.6-EL4.1.x86_64.rpm	SHA-256: 55fd818972855e7bf69c99e24ec52338f254fcb549f5a159c3c7959e417a2d61
wireshark-gnome-0.99.6-EL4.1.x86_64.rpm	SHA-256: 8f0f97f61229465b7c2c21a7507397bf651009c0e994e7eca3e395e633e45b7e
ia64
wireshark-0.99.6-EL4.1.ia64.rpm	SHA-256: eda143a1d6f9e067a743b1310d91eeae8b6537810569fb6ac5339d8dc4ff2795
wireshark-gnome-0.99.6-EL4.1.ia64.rpm	SHA-256: 0f51153b852e51fb83b942b9612cd99046dd9fcc88e1fb100f9beb2ffda262d4
i386
wireshark-0.99.6-EL4.1.i386.rpm	SHA-256: 7b4733082ebcf096bb0a0bd6290186c61dfcff2a413dc787874363558736838f
wireshark-gnome-0.99.6-EL4.1.i386.rpm	SHA-256: 7854732806781f7e40187239d20dbd790699795e530ed4e9ad7a31b702afa32c

Red Hat Enterprise Linux Desktop 4

SRPM
wireshark-0.99.6-EL4.1.src.rpm	SHA-256: 99f2bd8ccb2056e799fe2923ba64b8479eb29c864e99f53967d659202a1a01c8
x86_64
wireshark-0.99.6-EL4.1.x86_64.rpm	SHA-256: 55fd818972855e7bf69c99e24ec52338f254fcb549f5a159c3c7959e417a2d61
wireshark-gnome-0.99.6-EL4.1.x86_64.rpm	SHA-256: 8f0f97f61229465b7c2c21a7507397bf651009c0e994e7eca3e395e633e45b7e
i386
wireshark-0.99.6-EL4.1.i386.rpm	SHA-256: 7b4733082ebcf096bb0a0bd6290186c61dfcff2a413dc787874363558736838f
wireshark-gnome-0.99.6-EL4.1.i386.rpm	SHA-256: 7854732806781f7e40187239d20dbd790699795e530ed4e9ad7a31b702afa32c

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
wireshark-0.99.6-EL4.1.src.rpm	SHA-256: 99f2bd8ccb2056e799fe2923ba64b8479eb29c864e99f53967d659202a1a01c8
s390x
wireshark-0.99.6-EL4.1.s390x.rpm	SHA-256: 242c4eef5db37f86f1bb41fb7d82fe56a8e8c9a0fbb371037b23adc9a95567c4
wireshark-gnome-0.99.6-EL4.1.s390x.rpm	SHA-256: c6ba8c8df5416458a442be7366a36818c92b16dbfa64ec957b6d32d353643f65
s390
wireshark-0.99.6-EL4.1.s390.rpm	SHA-256: fe02e6ef473dcd338cb4b4e47609c28f235bf5879a2dd23bba7a6d2808b3cb3d
wireshark-gnome-0.99.6-EL4.1.s390.rpm	SHA-256: fc3b1f5559654c5f9c7f0c707fb3f9df62ed5b9a523684d052f822127365b4b9

Red Hat Enterprise Linux for Power, big endian 4

SRPM
wireshark-0.99.6-EL4.1.src.rpm	SHA-256: 99f2bd8ccb2056e799fe2923ba64b8479eb29c864e99f53967d659202a1a01c8
ppc
wireshark-0.99.6-EL4.1.ppc.rpm	SHA-256: 1a2ea981c1d550148842093eec92c4e8ded0f29a1629d7dc2dcc02ece9e68511
wireshark-gnome-0.99.6-EL4.1.ppc.rpm	SHA-256: 224f5ae75da16ea33eb7026dfffbd3c7d0afa9cce7b59104c2fe30b03a1e7328