OFFTOPIC Re: OpenLinux: Multiple vulnerabilities have reported in Ethereal 0.9.12 OFFTOPIC

["Kurt Seifried" <listuser () seifried org>]

OFFTOPIC

The last three were only fixed recently (like a week ago). I'm sorry but
Ethereal is not a critical package. To compromise a remote system via this
you'd have to know they run Ethereal with the vulnerable protocol dissectors
enabled, or send them a malicious packet capture to analyze. This is not a
real concern for most production systems (and based on Ethereal's extremely
poor security history admins should know better then to run it as root). I
don't blame them for holding off on an update (or simply putting it on the
back burner), it's of minor consequence to the vaste majority of users.
Vendors have finite resources, they have to allocate them appropriately, for
most this does not mean ethereal.

News at 9: Debian fixes epic4 IRC client, flaws originally fixed in May of
2003. End of world film at 11. I suppose we should castigate Debian for
placing the a huge number of users at risk via a remote flaw in it. Or maybe
not.

Kurt Seifried, kurt () seifried org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html