Re: Security issue resolution in 1.0.x series.

[Gerald Combs <gerald () wireshark org>]

Matty Ronald wrote:
> Hi All,
> I'm currently using Wireshark-1.0.9.  I just read the
> http://www.wireshark.org/security/wnpa-sec-2009-04.html
> My query is that will we see bugs and issues addresed in
> wnpa-sec-2009-04 be corrected in any future release of 1.0.x series?
>
> Please let me know if there are any plans in future to fix following
> vulnerabilities in 1.0.x series as i'm not keen on using gtk+2 support
> which is mandatory in 1.2.x version.
>
> The AFS dissector could crash. (Bug 3564) Versions affected: 0.9.2 to 1.2.0

Fixed in 1.0.9.

> The Infiniband dissector could crash on some platforms. Versions
> affected: 1.0.6 to 1.2.0

Looks like I missed this one. It has been added to the queue for 1.0.11.

> The RADIUS dissector could crash. (Bug 3578)
> Versions affected: 0.10.13 to 1.0.9, 1.2.0

Fixed in 1.0.10.

> My question is that will we see bugs and issues seen in 1.0.9 and
> 1.2.x series be fixed in any future release of 1.0.x series?

Yes. 1.0.10 was released on October 27 and fixes the RADIUS issue listed 
above.

> I also see that 1.0.11 is being planned to be released.So will it
> contain the fix for all the current open bugs/security issues ?

That's the plan.

> Is it possible to fix this issues in 1.0.x series itself?

Certainly. Again, that's the plan.

> I just read that Some vulnerabilities have been reported in Wireshark,
> which can be exploited by malicious people to cause a DoS (Denial of
> Service) or potentially compromise a user's system.
>
> 1) A boundary error in the Daintree SNA file parser can be exploited
> to cause a buffer overflow via a specially crafted capture file.
>
> Successful exploitation may allow execution of arbitrary code.
>
> 2) An error in the IPMI dissector on Windows can be exploited to cause a crash.
>
> The vulnerabilities are reported in versions 1.2.0 through 1.2.4.
>
> 3) An error in the SMB and SMB2 dissectors can be exploited to cause a crash.
>
> The vulnerability is reported in versions 0.9.0 through 1.2.4.
>
> So will all these issues/bugs be addressed in V1.0.11 ?

No. Daintree SNA parser doesn't exist in the 1.0.x branch so there's no 
"there" there to patch. Similarly, the affected IPMI code doesn't exist 
in the 1.0.x branch. The SMB and SMB2 fixes are in the queue for 1.0.11.

> Or does V1.0.10 address these issues?

It addresses some of them, as stated above. 1.0.11 will address the 
remainder as well as a RADIUS bug and a problem with libgcrypt on 
Windows 2000.

> Thanks in advance. Any response to above mail will be highly appreciated.
>
> Regards,
> Matty
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>              mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe