Synopsis

Moderate: wireshark security update

Type/Severity

Security Advisory: Moderate

Topic

Updated wireshark packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

Wireshark is a program for monitoring network traffic. Wireshark was
previously known as Ethereal.

A heap-based buffer overflow flaw was found in the Wireshark MAC-LTE
dissector. If Wireshark read a malformed packet off a network or opened a
malicious dump file, it could crash or, possibly, execute arbitrary code as
the user running Wireshark. (CVE-2011-0444)

A heap-based buffer overflow flaw was found in the way Wireshark processed
signaling traces generated by the Gammu utility on Nokia DCT3 phones
running in Netmonitor mode. If Wireshark opened a specially-crafted capture
file, it could crash or, possibly, execute arbitrary code as the user
running Wireshark. (CVE-2011-0713)

Several denial of service flaws were found in Wireshark. Wireshark could
crash or stop responding if it read a malformed packet off a network, or
opened a malicious dump file. (CVE-2011-0538, CVE-2011-1139, CVE-2011-1140,
CVE-2011-1141)

Users of Wireshark should upgrade to these updated packages, which contain
Wireshark version 1.2.15, and resolve these issues. All running instances
of Wireshark must be restarted for the update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386

Fixes

• BZ - 669441 - CVE-2011-0444 wireshark: buffer overflow in MAC-LTE disector (upstream bug #5530)
• BZ - 676232 - CVE-2011-0538 Wireshark: memory corruption when reading a malformed pcap file (upstream bug #5652)
• BZ - 678198 - CVE-2011-0713 Wireshark: heap-based buffer overflow when reading malformed Nokia DCT3 phone signalling traces
• BZ - 681748 - CVE-2011-1139 Wireshark: Denial Of Service (application crash) via a pcap-ng file that contains a large packet-length field
• BZ - 681754 - CVE-2011-1140 Wireshark: Multiple stack consumption vulnerabilities caused DoS via crafted SMB or CLDAP packet
• BZ - 681756 - CVE-2011-1141 Wireshark: Malformed LDAP filter string causes Denial of Service via excessive memory consumption

CVEs

• CVE-2011-0444
• CVE-2011-1141
• CVE-2011-1140
• CVE-2011-0538
• CVE-2011-1139
• CVE-2011-0713

References

• https://access.redhat.com/security/updates/classification/#moderate
• http://www.wireshark.org/security/wnpa-sec-2011-01.html
• http://www.wireshark.org/security/wnpa-sec-2011-03.html

Red Hat Enterprise Linux Server 6

SRPM
wireshark-1.2.15-1.el6_0.1.src.rpm	SHA-256: 28367c9aae838141c98ddd8b3fa5c4dcc4b094823e06be3a1a54cd18a60772fb
x86_64
wireshark-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 2ce80d6244003f61d60306d6dccb42ef051b535e9a46b4e47c7da8c807a70341
wireshark-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: 5e839cc69d8196232df6267da327993e632129bf356131b877c8cde8eb06b93f
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-debuginfo-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: ae3a481e7f6ce37bd8fcc58a827cd397d14b8bb62f5a4603d11377236f5c85f6
wireshark-debuginfo-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: ae3a481e7f6ce37bd8fcc58a827cd397d14b8bb62f5a4603d11377236f5c85f6
wireshark-devel-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 78fb4ad46c0e2f4cbc838b5837ce4a03ec0fb301d92f63c14dd262889c5c3bd1
wireshark-devel-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: 18315c3b84cb7de5fde54aa31012619d197ddeb6e57b1c90b420de6132d89a42
wireshark-gnome-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: 6dfdd502ddb8644de1176180d17d270ae255caaaf6bb33c5082d491c8b9c1b46
i386
wireshark-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 2ce80d6244003f61d60306d6dccb42ef051b535e9a46b4e47c7da8c807a70341
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-devel-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 78fb4ad46c0e2f4cbc838b5837ce4a03ec0fb301d92f63c14dd262889c5c3bd1
wireshark-gnome-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 5754ec41c9c84aeabad6579cf9a66f3cfcd0ba5df3c48a2b5cd7a1a0fa7f7fbf

Red Hat Enterprise Linux Workstation 6

SRPM
wireshark-1.2.15-1.el6_0.1.src.rpm	SHA-256: 28367c9aae838141c98ddd8b3fa5c4dcc4b094823e06be3a1a54cd18a60772fb
x86_64
wireshark-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 2ce80d6244003f61d60306d6dccb42ef051b535e9a46b4e47c7da8c807a70341
wireshark-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: 5e839cc69d8196232df6267da327993e632129bf356131b877c8cde8eb06b93f
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-debuginfo-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: ae3a481e7f6ce37bd8fcc58a827cd397d14b8bb62f5a4603d11377236f5c85f6
wireshark-debuginfo-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: ae3a481e7f6ce37bd8fcc58a827cd397d14b8bb62f5a4603d11377236f5c85f6
wireshark-devel-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 78fb4ad46c0e2f4cbc838b5837ce4a03ec0fb301d92f63c14dd262889c5c3bd1
wireshark-devel-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: 18315c3b84cb7de5fde54aa31012619d197ddeb6e57b1c90b420de6132d89a42
wireshark-gnome-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: 6dfdd502ddb8644de1176180d17d270ae255caaaf6bb33c5082d491c8b9c1b46
i386
wireshark-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 2ce80d6244003f61d60306d6dccb42ef051b535e9a46b4e47c7da8c807a70341
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-devel-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 78fb4ad46c0e2f4cbc838b5837ce4a03ec0fb301d92f63c14dd262889c5c3bd1
wireshark-gnome-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 5754ec41c9c84aeabad6579cf9a66f3cfcd0ba5df3c48a2b5cd7a1a0fa7f7fbf

Red Hat Enterprise Linux Desktop 6

SRPM
wireshark-1.2.15-1.el6_0.1.src.rpm	SHA-256: 28367c9aae838141c98ddd8b3fa5c4dcc4b094823e06be3a1a54cd18a60772fb
x86_64
wireshark-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 2ce80d6244003f61d60306d6dccb42ef051b535e9a46b4e47c7da8c807a70341
wireshark-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: 5e839cc69d8196232df6267da327993e632129bf356131b877c8cde8eb06b93f
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-debuginfo-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: ae3a481e7f6ce37bd8fcc58a827cd397d14b8bb62f5a4603d11377236f5c85f6
wireshark-debuginfo-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: ae3a481e7f6ce37bd8fcc58a827cd397d14b8bb62f5a4603d11377236f5c85f6
wireshark-devel-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 78fb4ad46c0e2f4cbc838b5837ce4a03ec0fb301d92f63c14dd262889c5c3bd1
wireshark-devel-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: 18315c3b84cb7de5fde54aa31012619d197ddeb6e57b1c90b420de6132d89a42
wireshark-gnome-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: 6dfdd502ddb8644de1176180d17d270ae255caaaf6bb33c5082d491c8b9c1b46
i386
wireshark-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 2ce80d6244003f61d60306d6dccb42ef051b535e9a46b4e47c7da8c807a70341
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-devel-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 78fb4ad46c0e2f4cbc838b5837ce4a03ec0fb301d92f63c14dd262889c5c3bd1
wireshark-gnome-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 5754ec41c9c84aeabad6579cf9a66f3cfcd0ba5df3c48a2b5cd7a1a0fa7f7fbf

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
wireshark-1.2.15-1.el6_0.1.src.rpm	SHA-256: 28367c9aae838141c98ddd8b3fa5c4dcc4b094823e06be3a1a54cd18a60772fb
s390x
wireshark-1.2.15-1.el6_0.1.s390.rpm	SHA-256: 67fc24ca4d275bca02892ad37db29a7248e96f35e918d922824db9454f5ee2fc
wireshark-1.2.15-1.el6_0.1.s390x.rpm	SHA-256: de338aaaec5f0f19c596ae538321e3b2ceda90b6e6a4c390f85e35af8ab20aeb
wireshark-debuginfo-1.2.15-1.el6_0.1.s390.rpm	SHA-256: ed11413ca1cc72e94aeac67cc4bc44320ca29a4f596764b9f0fabb8e97d04451
wireshark-debuginfo-1.2.15-1.el6_0.1.s390.rpm	SHA-256: ed11413ca1cc72e94aeac67cc4bc44320ca29a4f596764b9f0fabb8e97d04451
wireshark-debuginfo-1.2.15-1.el6_0.1.s390x.rpm	SHA-256: 1cc256cd6961670f1a927360a06b3b3371cdd886d113c924014348d31e8fd6d7
wireshark-debuginfo-1.2.15-1.el6_0.1.s390x.rpm	SHA-256: 1cc256cd6961670f1a927360a06b3b3371cdd886d113c924014348d31e8fd6d7
wireshark-devel-1.2.15-1.el6_0.1.s390.rpm	SHA-256: ec768ab2cb77dd88fd387a062f4efd4856a44407fe0c916c5055fb7a9ded59c7
wireshark-devel-1.2.15-1.el6_0.1.s390x.rpm	SHA-256: 8634ab50811cb150c8158d1609192f565cb63f22f93729792127bd685bd07259
wireshark-gnome-1.2.15-1.el6_0.1.s390x.rpm	SHA-256: fd4c89a12e094c0231dfc50f47770b7b31b80b6b66ca2d31cb7429c480c9baa4

Red Hat Enterprise Linux for Power, big endian 6

SRPM
wireshark-1.2.15-1.el6_0.1.src.rpm	SHA-256: 28367c9aae838141c98ddd8b3fa5c4dcc4b094823e06be3a1a54cd18a60772fb
ppc64
wireshark-1.2.15-1.el6_0.1.ppc.rpm	SHA-256: 53929077bb5ba7c093447e8028dce5243b31e600b6ad9efa0d4865a9310fc836
wireshark-1.2.15-1.el6_0.1.ppc64.rpm	SHA-256: 7f8232ff1b125b45f278375e7f9eead2b32c95d9012c56e3153d3b2595b3dcf8
wireshark-debuginfo-1.2.15-1.el6_0.1.ppc.rpm	SHA-256: 071d3d80c0e25ddae32d25b6e8948404543b5ed045f74aab3796b0f98aec3178
wireshark-debuginfo-1.2.15-1.el6_0.1.ppc.rpm	SHA-256: 071d3d80c0e25ddae32d25b6e8948404543b5ed045f74aab3796b0f98aec3178
wireshark-debuginfo-1.2.15-1.el6_0.1.ppc64.rpm	SHA-256: 10b57e54645be22d5a753375e9863c4e5ac65f961703a1d98b4ec9b7ee902257
wireshark-debuginfo-1.2.15-1.el6_0.1.ppc64.rpm	SHA-256: 10b57e54645be22d5a753375e9863c4e5ac65f961703a1d98b4ec9b7ee902257
wireshark-devel-1.2.15-1.el6_0.1.ppc.rpm	SHA-256: 7d712dc58853c970c39ea2515fd479d529c1d6e77fc1b0aed560e39c1eb50e0e
wireshark-devel-1.2.15-1.el6_0.1.ppc64.rpm	SHA-256: 97eadeaee37143c13075735c408f7b1fc76f424281725eecbb05703324dd9689
wireshark-gnome-1.2.15-1.el6_0.1.ppc64.rpm	SHA-256: f980f671024cbca93eb5a7a11b7718d734296564674deeeec3ce35d36fe5f28e

Red Hat Enterprise Linux Server from RHUI 6

SRPM
wireshark-1.2.15-1.el6_0.1.src.rpm	SHA-256: 28367c9aae838141c98ddd8b3fa5c4dcc4b094823e06be3a1a54cd18a60772fb
x86_64
wireshark-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 2ce80d6244003f61d60306d6dccb42ef051b535e9a46b4e47c7da8c807a70341
wireshark-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: 5e839cc69d8196232df6267da327993e632129bf356131b877c8cde8eb06b93f
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-debuginfo-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: ae3a481e7f6ce37bd8fcc58a827cd397d14b8bb62f5a4603d11377236f5c85f6
wireshark-debuginfo-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: ae3a481e7f6ce37bd8fcc58a827cd397d14b8bb62f5a4603d11377236f5c85f6
wireshark-devel-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 78fb4ad46c0e2f4cbc838b5837ce4a03ec0fb301d92f63c14dd262889c5c3bd1
wireshark-devel-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: 18315c3b84cb7de5fde54aa31012619d197ddeb6e57b1c90b420de6132d89a42
wireshark-gnome-1.2.15-1.el6_0.1.x86_64.rpm	SHA-256: 6dfdd502ddb8644de1176180d17d270ae255caaaf6bb33c5082d491c8b9c1b46
i386
wireshark-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 2ce80d6244003f61d60306d6dccb42ef051b535e9a46b4e47c7da8c807a70341
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-debuginfo-1.2.15-1.el6_0.1.i686.rpm	SHA-256: adf628e724ddb93a91653057f8c036a29a1fb52e16eab35c30eaad2d96cb04b7
wireshark-devel-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 78fb4ad46c0e2f4cbc838b5837ce4a03ec0fb301d92f63c14dd262889c5c3bd1
wireshark-gnome-1.2.15-1.el6_0.1.i686.rpm	SHA-256: 5754ec41c9c84aeabad6579cf9a66f3cfcd0ba5df3c48a2b5cd7a1a0fa7f7fbf