From Mageia wiki
Jump to: navigation, search

MGASA-2012-0206

Date: August 12th, 2012
Affected releases: 1


Description:
Updated wireshark packages fix security vulnerabilities:

Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allows remote
attackers to cause a denial of service (infinite loop) via vectors
related to the (1) ANSI MAP, (2) ASF, (3) IEEE 802.11, (4) IEEE 802.3,
and (5) LTP dissectors (CVE-2012-2392).

Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 on the SPARC and
Itanium platforms does not properly perform data alignment for a certain
structure member, which allows remote attackers to cause a denial of
service (application crash) via a (1) ICMP or (2) ICMPv6 Echo Request
packet (CVE-2012-2394).

The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9,
and 1.8.x before 1.8.1 allows remote attackers to cause a denial of
service (invalid pointer dereference and application crash) via a
crafted packet, as demonstrated by a usbmon dump (CVE-2012-4048).

epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x
before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote
attackers to cause a denial of service (loop and CPU consumption) via a
crafted packet (CVE-2012-4049).

Note: CVE-2012-2393 (denial of service flaw in the DIAMETER dissector)
is *NOT* fixed by this update, despite being listed as fixed in the
Wireshark 1.4.13 release notes. See Wireshark bug 7399 for more.


Updated Packages:
dumpcap-1.4.14-1.mga1
lib(64)wireshark0-1.4.14-1.mga1
lib(64)wireshark-devel-1.4.14-1.mga1
rawshark-1.4.14-1.mga1
tshark-1.4.14-1.mga1
wireshark-1.4.14-1.mga1
wireshark-tools-1.4.14-1.mga1


References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2392
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2393
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2394
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4048
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4049
http://www.wireshark.org/security/wnpa-sec-2012-08.html
http://www.wireshark.org/security/wnpa-sec-2012-10.html
http://www.wireshark.org/security/wnpa-sec-2012-11.html
http://www.wireshark.org/security/wnpa-sec-2012-12.html
http://www.wireshark.org/docs/relnotes/wireshark-1.4.13.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7399
http://www.wireshark.org/news/20120522.html
http://www.wireshark.org/news/20120722.html
https://bugs.mageia.org/show_bug.cgi?id=6033