[ GLSA 200607-09 ] Wireshark: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: Wireshark: Multiple vulnerabilities (GLSA 200607-09)
Severity: high
Exploitable: remote
Date: July 25, 2006
Bug(s): #140856
ID: 200607-09

Synopsis


Wireshark (formerly known as Ethereal) is vulnerable to several security
issues, potentially allowing the execution of arbitrary code by a remote
attacker.


Background


Wireshark, formerly known as Ethereal, is a popular network protocol
analyzer.


Affected Packages

Package: net-analyzer/wireshark
Vulnerable: < 0.99.2
Unaffected: >= 0.99.2
Architectures: All supported architectures

Package: net-analyzer/ethereal
Vulnerable: <= 0.99.0-r1
Architectures: All supported architectures


Description


Wireshark dissectors have been found vulnerable to a large number of
exploits, including off-by-one errors, buffer overflows, format string
overflows and an infinite loop.


Impact


Running an affected version of Wireshark or Ethereal could allow for a
remote attacker to execute arbitrary code on the user's computer by
sending specially crafted packets.


Workaround


There is no known workaround at this time.


Resolution


All Wireshark users should upgrade to the latest version: