[wireshark] multiple vulnerabilities

Further exploits for wireshark .99.6 (gutsy)

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6451
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6449
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6448
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6447
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6446
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6445
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6444
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6443
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6442
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6441
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6440
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6439
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6438

Note, these are fixed in .99.7 which is currently in hardy (security backport?)

See also DSA-1446-1 (http://www.debian.org/security/2007/dsa-1446).

Sorry, I posted a slightly wrong URL to DSA-1446-1.

http://www.debian.org/security/2008/dsa-1446

Also added missing CVE references mentioned in SUSE Security Summary Report SUSE-SR:2008:004.

These CVEs are already fixed in Ubuntu...

See https://bugs.launchpad.net/ubuntu/+source/wireshark/+bug/164501

    * 2007-6111
    * 2007-6112
    * 2007-6113
    * 2007-6114
    * 2007-6115
    * 2007-6116
    * 2007-6117
    * 2007-6118
    * 2007-6119
    * 2007-6120
    * 2007-6121

I'll deal with it during the next weekend...
Or as Dr. VanDoom said in "The Fantastic Four"
     "This will be fun..."

There are also new issues in 0.99.7:
From upstream:

Summary

Name: Multiple problems in Wireshark® (formerly Ethereal®) versions 0.6.0 to 0.99.7

Docid: wnpa-sec-2008-01

Date: February 27, 2008

Versions affected: 0.6.0 up to and including 0.99.7
Details
Description

Wireshark 0.99.8 fixes the following vulnerabilities:

    * The SCTP dissector could crash.
      Versions affected: 0.99.5 to 0.99.7
    * The SNMP dissector could crash. (Bugs 2144 and 2277)
      Versions affected: 0.99.6 to 0.99.7
    * The TFTP dissector could crash Wireshark on Ubuntu 7.10. (This appears to be a bug in the Cairo library on that platform.) Reported by Noam Rathaus.
      Versions affected: 0.6.0 to 0.99.7

Impact

It may be possible to make Wireshark or Ethereal crash or use up available memory by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
Resolution

Upgrade to Wireshark 0.99.8.

If are running Wireshark 0.99.7 or Ethereal 0.99.0 or earlier and cannot upgrade, you can work around each of the problems listed above by doing the following:

    * Disable the SCTP, SNMP and TFTP dissectors.
          o Select Analyze→Enabled Protocols... from the menu.
          o Make sure "SCTP," "SNMP," and "TFTP" are un-checked.
          o Click "Save", then click "OK".

Also adding CVE references mentioned in MDVSA-2008:057 (http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:057).

Um, I guess the CVE references list got a little too long, because the added references won't show up any more...

Adding them here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1070
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1071
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1072

Should newly discovered vulnerabilities regarding wireshark be reported in a new bug report? I'd guess I'm not the only one who's currently a bit in the dark regarding which CVEs are still affecting Ubuntu's wireshark...

Okay, after mentioning the new CVEs in my previous comment, they suddenly showed up in the CVE references list. Weird.

Please push new CVEs into a new bugreport....
It's difficult (especially for wireshark) to fix all bugs in one go...so I would like to see separated bug reports...

thx for you work,

\sh

removed duplicated CVS

CVE-2008-1071 does not seem to be reproducible in gutsy.

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2144

@Emanuele:

Did you test it with our version in gutsy?

yes

@Emgent: debdiff looks good

@Kees/JdStrand: can you put it on your radar pls for gutsy...

Thx.

\sh

This is building now, and will be published shortly in Gutsy. Thanks!

(Manually flipping to "Fix Released") This has published as part of the first-ever end-to-end test run of the shiny new security-in-soyuz queues. :)