Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal.

Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malformed dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-4683, CVE-2009-0599)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malformed dump file. (CVE-2008-4680, CVE-2008-4681, CVE-2008-4682, CVE-2008-4684, CVE-2008-4685, CVE-2008-5285, CVE-2009-0600)

Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.6, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.

Red Hat セキュリティアドバイザリ 2009:0313 から：

複数のセキュリティ問題を修正する、更新済みの wireshark パッケージが Red Hat Enterprise Linux 3、4 および 5 で現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新は重要度中のセキュリティ影響があると評価しています。

Wireshark はネットワークトラフィックをモニターするプログラムです。Wireshark は以前、Ethereal として知られていました。

Wireshark で複数のバッファオーバーフローの欠陥が見つかりました。Wireshark がネットワークから無効な形式のパケットを読み取ったり、無効な形式のダンプファイルを開いたりした場合、 Wireshark をクラッシュさせたり、 Wireshark を実行しているユーザーとして任意のコードを実行したりすることが可能です。（CVE-2008-4683、 CVE-2009-0599）

Wireshark にいくつかのサービス拒否の欠陥が見つかりました。Wireshark が、ネットワークから無効な形式のパケットを読み取ったり、無効な形式のダンプファイルを開いた場合、 Wireshark がクラッシュしたり、応答不能になったりする可能性があります。（CVE-2008-4680、CVE-2008-4681、CVE-2008-4682、CVE-2008-4684、CVE-2008-4685、CVE-2008-5285、CVE-2009-0600）

Wireshark のユーザーはこれらの問題を解決する Wireshark バージョン 1.0.6 が含まれる更新済みパッケージへアップグレードする必要があります。この更新を有効にするには、 Wireshark の実行中のインスタンスすべてを、再起動する必要があります。

來自 Red Hat 安全性公告 2009:0313：

現已提供適用於 Red Hat Enterprise Linux 3、4 與 5 的更新版 wireshark 套件，可修正數個安全性問題。

Red Hat 安全性回應團隊已將此更新評等為具有中等安全性影響。

Wireshark 是用於監控網路流量的程式。Wireshark 之前稱為 Ethereal。

在 Wireshark 中發現多個緩衝區溢位瑕疵。如果 Wireshark 在網路外讀取格式有誤的封包，或開啟格式有誤的轉儲存檔案，可造成當機，或以執行 Wireshark 的使用者身分執行任意程式碼。(CVE-2008-4683、CVE-2009-0599)

在 Wireshark 中發現數個拒絕服務瑕疵。如果 Wireshark 在網路外讀取格式有誤的封包，或開啟格式有誤的轉儲存檔案，可能會損毀或停止回應。(CVE-2008-4680、CVE-2008-4681、CVE-2008-4682、CVE-2008-4684、CVE-2008-4685、CVE-2008-5285、CVE-2009-0600)

wireshark 使用者應升級至這些更新版套件，其包含 Wireshark 1.0.6 版，並可解決這些問題。必須重新啟動所有執行中的 Wireshark 執行個體，更新才會生效。

来自 Red Hat 安全公告 2009:0313：

更新后的 wireshark 程序包修复了多个安全问题，现在可用于 Red Hat Enterprise Linux 3、4 和 5。

Red Hat 安全响应团队将此更新评级为具有中等安全影响。

Wireshark 是用于监视网络流量的程序。Wireshark 之前被称为 Ethereal。

在 Wireshark 中发现多个缓冲区溢出缺陷。如果 Wireshark 读取网络中的畸形数据包或打开恶意转储文件，它可能崩溃或可能以运行 Wireshark 的用户的身份执行任意代码。（CVE-2008-4683、CVE-2009-0599）

在 Wireshark 中发现多个拒绝服务缺陷。如果 Wireshark 读取网络中的畸形包或打开畸形转储文件，则可能崩溃或停止响应。（CVE-2008-4680、CVE-2008-4681、CVE-2008-4682、CVE-2008-4684、CVE-2008-4685、CVE-2008-5285、CVE-2009-0600）

wireshark 用户应升级这些更新后的程序包，其中包含 Wireshark 版本 1.0.6 并解决这些问题。必须重新启动所有正在运行的 Wireshark 实例，才能使更新生效。

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0313 advisory.

    [1.0.6-2.0.1.el5_3]
    - Add oracle-ocfs2-network.patch

    [1.0.6-2]
    - bring back pie
    - Resolves: #486551

    [1.0.6-1]
    - various security flaws fixed
    - upgrade to 1.0.6
    - Resolves: #486551

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two vulnerabilities were discovered in Wireshark. The first is a vulnerability in the SMTP dissector that could cause it to consume excessive CPU and memory via a long SMTP request (CVE-2008-5285).

The second is an issue with the WLCCP dissector that could cause it to go into an infinite loop.

This update also provides a patch to fix a potential freeze during capture interface selection.

This update provides Wireshark 1.0.5, which is not vulnerable to these issues.

The remote host is affected by the vulnerability described in GLSA-200906-05 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark:
    David Maciejak discovered a vulnerability in packet-usb.c in the USB     dissector via a malformed USB Request Block (URB) (CVE-2008-4680).
    Florent Drouin and David Maciejak reported an unspecified vulnerability     in the Bluetooth RFCOMM dissector (CVE-2008-4681).
    A malformed Tamos CommView capture file (aka .ncf file) with an     'unknown/unexpected packet type' triggers a failed assertion in wtap.c     (CVE-2008-4682).
    An unchecked packet length parameter in the dissect_btacl() function in     packet-bthci_acl.c in the Bluetooth ACL dissector causes an erroneous     tvb_memcpy() call (CVE-2008-4683).
    A vulnerability where packet-frame does not properly handle exceptions     thrown by post dissectors caused by a certain series of packets     (CVE-2008-4684).
    Mike Davies reported a use-after-free vulnerability in the     dissect_q931_cause_ie() function in packet-q931.c in the Q.931     dissector via certain packets that trigger an exception     (CVE-2008-4685).
    The Security Vulnerability Research Team of Bkis reported that the SMTP     dissector could consume excessive amounts of CPU and memory     (CVE-2008-5285).
    The vendor reported that the WLCCP dissector could go into an infinite     loop (CVE-2008-6472).
    babi discovered a buffer overflow in wiretap/netscreen.c via a     malformed NetScreen snoop file (CVE-2009-0599).
    A specially crafted Tektronix K12 text capture file can cause an     application crash (CVE-2009-0600).
    A format string vulnerability via format string specifiers in the HOME     environment variable (CVE-2009-0601).
    THCX Labs reported a format string vulnerability in the     PROFINET/DCP (PN-DCP) dissector via a PN-DCP packet with format string     specifiers in the station name (CVE-2009-1210).
    An unspecified vulnerability with unknown impact and attack vectors     (CVE-2009-1266).
    Marty Adkins and Chris Maynard discovered a parsing error in the     dissector for the Check Point High-Availability Protocol (CPHAP)     (CVE-2009-1268).
    Magnus Homann discovered a parsing error when loading a Tektronix .rf5     file (CVE-2009-1269).
    The vendor reported that the PCNFSD dissector could crash     (CVE-2009-1829).
  Impact :

    A remote attacker could exploit these vulnerabilities by sending     specially crafted packets on a network being monitored by Wireshark or     by enticing a user to read a malformed packet trace file which can     trigger a Denial of Service (application crash or excessive CPU and     memory usage) and possibly allow for the execution of arbitrary code     with the privileges of the user running Wireshark.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
35767	CentOS 3 / 4 : wireshark (CESA-2009:0313)	Nessus	CentOS Local Security Checks	2009/3/5	2021/1/4	medium
67809	Oracle Linux 3/4/5：wireshark（ELSA-2009-0313）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
67809	Oracle Linux 3 / 4 / 5 : wireshark (ELSA-2009-0313)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
67809	Oracle Linux 3 / 4 / 5：wireshark (ELSA-2009-0313)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
67809	Oracle Linux 5 : wireshark (ELSA-2009-0313)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
37127	Mandriva Linux Security Advisory : wireshark (MDVSA-2008:242)	Nessus	Mandriva Local Security Checks	2009/4/23	2021/1/6	medium
39580	GLSA-200906-05 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2009/7/1	2021/1/6	critical
35772	RHEL 3 / 4 / 5 : wireshark (RHSA-2009:0313)	Nessus	Red Hat Local Security Checks	2009/3/5	2021/1/14	medium

检测

插件搜索

medium

high

high

high

high

medium

critical

medium