Your message dated Thu, 30 Jul 2009 05:47:17 +0000
with message-id <e1mwou1-0004t1...@ries.debian.org>
and subject line Bug#538237: fixed in wireshark 1.2.1-1
has caused the Debian Bug report #538237,
regarding CVE-2009-2559 CVE-2009-2560 CVE-2009-2561 CVE-2009-2562
CVE-2009-2563: Wireshark Multiple Vulnerabilities
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
538237: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=538237
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: wireshark
Version: 1.0.8-1
Severity: serious
Tags: security
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
the following CVE (Common Vulnerabilities & Exposures) ids were
published for wireshark.
CVE-2009-2559[0]:
| Buffer overflow in the IPMI dissector in Wireshark 1.2.0 allows remote
| attackers to cause a denial of service (crash) via unspecified vectors
| related to an array index error. NOTE: some of these details are
| obtained from third party information.
CVE-2009-2560[1]:
| Multiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote
| attackers to cause a denial of service (crash) via unspecified vectors
| in the (1) Bluetooth L2CAP, (2) RADIUS, or (3) MIOP dissectors.
CVE-2009-2561[2]:
| Unspecified vulnerability in the sFlow dissector in Wireshark 1.2.0
| allows remote attackers to cause a denial of service (CPU and memory
| consumption) via unspecified vectors.
CVE-2009-2562[3]:
| Unspecified vulnerability in the AFS dissector in Wireshark 0.9.2
| through 1.2.0 allows remote attackers to cause a denial of service
| (crash) via unknown vectors.
CVE-2009-2563[4]:
| Unspecified vulnerability in the Infiniband dissector in Wireshark
| 1.0.6 through 1.2.0, when running on unspecified platforms, allows
| remote attackers to cause a denial of service (crash) via unknown
| vectors.
If you fix the vulnerabilities please also make sure to include the
CVE ids in your changelog entry.
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2559
http://security-tracker.debian.net/tracker/CVE-2009-2559
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2560
http://security-tracker.debian.net/tracker/CVE-2009-2560
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2561
http://security-tracker.debian.net/tracker/CVE-2009-2561
[3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2562
http://security-tracker.debian.net/tracker/CVE-2009-2562
[4] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2563
http://security-tracker.debian.net/tracker/CVE-2009-2563
Cheers,
Giuseppe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkppenoACgkQNxpp46476apJegCfX3KPSfs6vuNIqxo+QBTZuPwe
cR0An3b3IqIeKHehSxWtc8YGPzFvPPAB
=wBS6
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
Source: wireshark
Source-Version: 1.2.1-1
We believe that the bug you reported is fixed in the latest version of
wireshark, which is due to be installed in the Debian FTP archive:
tshark_1.2.1-1_amd64.deb
to pool/main/w/wireshark/tshark_1.2.1-1_amd64.deb
wireshark-common_1.2.1-1_amd64.deb
to pool/main/w/wireshark/wireshark-common_1.2.1-1_amd64.deb
wireshark-dev_1.2.1-1_amd64.deb
to pool/main/w/wireshark/wireshark-dev_1.2.1-1_amd64.deb
wireshark_1.2.1-1.diff.gz
to pool/main/w/wireshark/wireshark_1.2.1-1.diff.gz
wireshark_1.2.1-1.dsc
to pool/main/w/wireshark/wireshark_1.2.1-1.dsc
wireshark_1.2.1-1_amd64.deb
to pool/main/w/wireshark/wireshark_1.2.1-1_amd64.deb
wireshark_1.2.1.orig.tar.gz
to pool/main/w/wireshark/wireshark_1.2.1.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 538...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Balint Reczey <bal...@balintreczey.hu> (supplier of updated wireshark package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Tue, 14 Jul 2009 20:01:56 +0200
Source: wireshark
Binary: wireshark-common wireshark tshark wireshark-dev
Architecture: source amd64
Version: 1.2.1-1
Distribution: unstable
Urgency: high
Maintainer: Frederic Peters <fpet...@debian.org>
Changed-By: Balint Reczey <bal...@balintreczey.hu>
Description:
tshark - network traffic analyzer (console)
wireshark - network traffic analyzer
wireshark-common - network traffic analyser (common files)
wireshark-dev - network traffic analyser (development tools)
Closes: 470316 518441 538237
Changes:
wireshark (1.2.1-1) unstable; urgency=high
.
* New upstream release 1.2.1
- release notes:
http://www.wireshark.org/docs/relnotes/wireshark-1.2.1.html
- security fixes
- The IPMI dissector could overrun a buffer. (CVE-2009-2559)
- The AFS dissector could crash. (CVE-2009-2562)
- The Infiniband dissector could crash on some platforms.
(CVE-2009-2563)
- The Bluetooth L2CAP dissector could crash. (CVE-2009-2560)
- The RADIUS dissector could crash. (CVE-2009-2560)
- The MIOP dissector could crash. (CVE-2009-2560)
- The sFlow dissector could use excessive CPU and memory.
(CVE-2009-2561)
(Closes: #538237)
* dropped gnutls pkg-config patch as it has been integrated upstream
* include asn2wrs.py (Closes: #518441)
* fix inclusion of Python modules wireshark_be.py and wireshark_gen.py
* updated idl2deb (Closes: #470316)
Thanks to W. Borgert for the patch.
* override lintian warning binary-or-shlib-defines-rpath
* update standards-version to 3.8.2
Checksums-Sha1:
79a8df10614c5c821da5b3be0465b8b058f01950 1496 wireshark_1.2.1-1.dsc
34659dc7129e121b1c0adf705ced877e8a5c5d1a 19519638 wireshark_1.2.1.orig.tar.gz
0f9f87d193779a1731efa8e6ed0fa8a25a2c0d1d 37426 wireshark_1.2.1-1.diff.gz
62bf2527ea93d00c38b0e8e14248e5647163c78b 13589334
wireshark-common_1.2.1-1_amd64.deb
8cbc9abbc605a9599a11806722e04b616cb4cf0f 711192 wireshark_1.2.1-1_amd64.deb
bd33e5c22c08bfddb9782efc671999879c9408cb 126208 tshark_1.2.1-1_amd64.deb
a7b1c83dfc729f1f87f886cde3028562115b6129 785500 wireshark-dev_1.2.1-1_amd64.deb
Checksums-Sha256:
42f0eaf7bdbfa2be99cded74e8f8ff72caf51aa28b65a194435665f48e5de0a0 1496
wireshark_1.2.1-1.dsc
6fa8603eafe1b871ff8bbec1d8151fb869669c5fdea4e34d01a36bbb43c9dc79 19519638
wireshark_1.2.1.orig.tar.gz
2e69cd4e2991df9acccf705ba59c1b996017adf0cf71aea66022ab78b5c79ac8 37426
wireshark_1.2.1-1.diff.gz
ecd31d665cea6f5e556c26ad61c810723941e6ba7f2ea8d7c8072e1409076f82 13589334
wireshark-common_1.2.1-1_amd64.deb
fa6397d79afc568f36091a478213d39f85af5f14a5fa3d6b0286d524be68f241 711192
wireshark_1.2.1-1_amd64.deb
6945447badcfe2df69312e3244eadf734b6199be75b0b82174f36c459066f28a 126208
tshark_1.2.1-1_amd64.deb
36cd610778ae43eef5bf195485878ed8fd0d46f18c98673f3ad16f1d4d20e5e0 785500
wireshark-dev_1.2.1-1_amd64.deb
Files:
77aeef0904604ad2619111bf99f1c181 1496 net optional wireshark_1.2.1-1.dsc
cfc051fec3f5a1f55783688ed84251b6 19519638 net optional
wireshark_1.2.1.orig.tar.gz
c2057490f01b2ef107b7f2be11e03e1d 37426 net optional wireshark_1.2.1-1.diff.gz
259148d04050ecd0bfbf489577da1286 13589334 net optional
wireshark-common_1.2.1-1_amd64.deb
b7b4d0ea4ddf444f17147f838e639371 711192 net optional
wireshark_1.2.1-1_amd64.deb
f3be786db8365c3cd89b44abaf13658a 126208 net optional tshark_1.2.1-1_amd64.deb
4b3453dd2cac85d771857f2a78b51351 785500 devel optional
wireshark-dev_1.2.1-1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkpxLroACgkQ0/r2+3z8lN1EzACfScLAnKfjgUgbUett9mC96mPe
1RAAmweLC3a6k5Mo1cPqr2+jqegsMpyy
=nGkd
-----END PGP SIGNATURE-----
--- End Message ---
