Attachment 17022 Details for Bug 50449

ongoing vendor-sec discussion

ethereal.txt (text/plain), 14.01 KB, created by Thomas Biege on 2004-03-23 16:10:46 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2004-03-23 16:10:46 UTC

Size: 14.01 KB

patch

obsolete

>From s.esser@e-matters.de Tue Mar 23 09:06:37 2004
>Date: Mon, 22 Mar 2004 18:13:20 +0100
>From: Stefan Esser <s.esser@e-matters.de>
>To: vendor-sec@lst.de
>Subject: [vendor-sec] Ethereal Advisory
>
>Hello,
>
>out of a sudden I got a mail from the Ethereal "boss" sending me the
>link and the notice that he will release the new version on wednesday
>or thursday.
>
>Obviously the document is linked from their website and beside the
>fact that it lacks 3 overflows (the UCPs) it tells the users to
>upgrade to v0.10.3 which does not exist yet ...
>
>Right now I wonder if I should wait until 0.10.3 is out or release
>an advisory tonight.
>
>Stefan Esser
>
>PS: Mark could you send me an overview what CVE names were given?
>
>Here the document...
>
>------------------------------------------------------------------------
>
>Summary:
>
>Name: Multiple security problems in Ethereal 0.10.2
>
>Docid: enpa-sa-00013
>
>Date: March 22, 2004
>
>Versions affected: 0.8.13 up to and including 0.10.2
>
>Severity: High 
>
>Details
>Description:
>
>Serious issues have been discovered in the following protocol dissectors: 
>
>Stefan Esser discovered ten buffer overflows in the following protocol dissectors: NetFlow, IGAP, EIGRP, PGM, IrDA, BGP, ISUP, and TCAP. 
>A zero-length Presentation protocol selector could make Ethereal crash. 
>Jonathan Heussser discovered that a carefully-crafted RADIUS packet could cause a crash. 
>A corrupt color filter file could cause a segmentation fault. 
>
>Impact:
>
>It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire, by convincing someone to read a malformed packet trace file, or by creating a malformed color filter file. 
>
>Resolution:
>
>Upgrade to 0.10.3.
>
>If you are running a version prior to 0.10.3 and you cannot upgrade, you can disable all of the protocol dissectors listed above by selecting Edit->Protocols... and deselecting them from the list. However, it is strongly recommended that you upgrade to 0.10.3. 
>
>
>
>-- 
>
>--------------------------------------------------------------------------
> Stefan Esser                                        s.esser@e-matters.de
> e-matters Security                         http://security.e-matters.de/
>
> GPG-Key                gpg --keyserver pgp.mit.edu --recv-key 0xCF6CAE69 
> Key fingerprint       B418 B290 ACC0 C8E5 8292  8B72 D6B0 7704 CF6C AE69
>--------------------------------------------------------------------------
> Did I help you? Consider a gift:            http://wishlist.suspekt.org/
>--------------------------------------------------------------------------
>
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From mjc@redhat.com Tue Mar 23 09:06:54 2004
>Date: Mon, 22 Mar 2004 17:35:58 +0000 (GMT)
>From: Mark J Cox <mjc@redhat.com>
>To: Stefan Esser <s.esser@e-matters.de>
>Cc: vendor-sec@lst.de
>Subject: Re: [vendor-sec] Ethereal Advisory
>
>> Obviously the document is linked from their website and beside the
>> fact that it lacks 3 overflows (the UCPs) it tells the users to
>> upgrade to v0.10.3 which does not exist yet ...
>
>So I gave a single name, CAN-2004-0176 to these issues.  However if and
>only if 0.10.3 doesn't contain the three UCPs then we need a separate name
>for those issues - use CAN-2004-0181 for them.
>
>Mark
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From s.esser@e-matters.de Tue Mar 23 09:07:20 2004
>Date: Mon, 22 Mar 2004 18:36:27 +0100
>From: Stefan Esser <s.esser@e-matters.de>
>To: Mark J Cox <mjc@redhat.com>
>Cc: vendor-sec@lst.de
>Subject: Re: [vendor-sec] Ethereal Advisory
>
>Hi again,
>
>> So I gave a single name, CAN-2004-0176 to these issues.  However if and
>> only if 0.10.3 doesn't contain the three UCPs then we need a separate name
>> for those issues - use CAN-2004-0181 for them.
>
>0.10.3 will contain the three UCPs. Only their advisory is slightly
>incorrect. It first said that I found 10 bugs. It was corrected to
>say 13 in the meanwhile. But it still does not mention UCP as affected
>dissector. However the code is fixed in CVS and as far as I can see
>0.10.3 will be a full release and not only a security fix so it is
>quite unlikely that UCP is not fixed in it.
>
>Stefan
>
>-- 
>
>--------------------------------------------------------------------------
> Stefan Esser                                        s.esser@e-matters.de
> e-matters Security                         http://security.e-matters.de/
>
> GPG-Key                gpg --keyserver pgp.mit.edu --recv-key 0xCF6CAE69 
> Key fingerprint       B418 B290 ACC0 C8E5 8292  8B72 D6B0 7704 CF6C AE69
>--------------------------------------------------------------------------
> Did I help you? Consider a gift:            http://wishlist.suspekt.org/
>--------------------------------------------------------------------------
>
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From mjc@redhat.com Tue Mar 23 09:07:27 2004
>Date: Mon, 22 Mar 2004 17:44:45 +0000 (GMT)
>From: Mark J Cox <mjc@redhat.com>
>To: Stefan Esser <s.esser@e-matters.de>
>Cc: vendor-sec@lst.de
>Subject: Re: [vendor-sec] Ethereal Advisory
>
>Okay, then CAN-2004-0176 for all
>
>Thanks, Mark
>
>On Mon, 22 Mar 2004, Stefan Esser wrote:
>
>> Hi again,
>> 
>> > So I gave a single name, CAN-2004-0176 to these issues.  However if and
>> > only if 0.10.3 doesn't contain the three UCPs then we need a separate name
>> > for those issues - use CAN-2004-0181 for them.
>> 
>> 0.10.3 will contain the three UCPs. Only their advisory is slightly
>> incorrect. It first said that I found 10 bugs. It was corrected to
>> say 13 in the meanwhile. But it still does not mention UCP as affected
>> dissector. However the code is fixed in CVS and as far as I can see
>> 0.10.3 will be a full release and not only a security fix so it is
>> quite unlikely that UCP is not fixed in it.
>> 
>> Stefan
>> 
>> 
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From mdz@debian.org Tue Mar 23 09:07:38 2004
>Date: Mon, 22 Mar 2004 11:07:00 -0800
>From: Matt Zimmerman <mdz@debian.org>
>To: vendor-sec@lst.de
>Subject: [vendor-sec] [jonny@drugphish.ch: Re: vulnerability in ethereal
>    0.10.2]
>
>Looks like a DoS; since we'll likely all be doing ethereal updates anyway...
>No CAN yet; this is public, so waiting for Mitre.
>
>Trivial fix is here:
>
>Revision 1.100 / (colorized) - annotated - [select for diffs] , Mon Mar 22
>16:05:48 2004 UTC (3 hours ago) by gerald
>Branch: MAIN
>CVS Tags: HEAD
>Changes since 1.99: +6 -2 lines
>Diff to previous 1.99
>
>Handle null RADIUS attribute information without crashing.  Found by
>Jonathan Heusser.
>
>----- Forwarded message from Jonathan Heusser <jonny@drugphish.ch> -----
>
>Date: Mon, 22 Mar 2004 20:49:24 +0100
>From: Jonathan Heusser <jonny@drugphish.ch>
>To: Matt Zimmerman <mdz@debian.org>
>Subject: Re: vulnerability in ethereal 0.10.2
>
>Matt Zimmerman wrote:
>
>>On Mon, Mar 22, 2004 at 07:04:46PM +0100, Jonathan Heusser wrote:
>>
>> 
>>
>>>I found a vulnerability in the radius dissector of the current stable 
>>>ethereal version.
>>>The CVS version is fixed now. Details under:
>>>http://marc.theaimsgroup.com/?l=ethereal-dev&m=107962966700423&w=2
>>>   
>>>
>>
>>Thanks; do you have any information about the final fix?  In that message,
>>you mention a possible solution, but aren't sure whether it is best.
>> 
>>
>Gerald Combs commited a fix to the CVS version and I just sent him some 
>tcpdump captures to test it.
>For me the fix looks appropriate.
>
>-- 
>Key fingerprint = 2A55 EB7C B7EA 6336 7767  4A47 910A 307B 1333 BD6C
>
>----- End forwarded message -----
>
>-- 
> - mdz
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From trini@mvista.com Tue Mar 23 09:07:51 2004
>Date: Mon, 22 Mar 2004 12:28:12 -0700
>From: Tom Rini <trini@mvista.com>
>To: vendor-sec@lst.de
>Subject: Re: [vendor-sec] [jonny@drugphish.ch: Re: vulnerability in ethereal
>     0.10.2]
>
>On Mon, Mar 22, 2004 at 11:07:00AM -0800, Matt Zimmerman wrote:
>
>> Looks like a DoS; since we'll likely all be doing ethereal updates anyway...
>> No CAN yet; this is public, so waiting for Mitre.
>> 
>> Trivial fix is here:
>> 
>> Revision 1.100 / (colorized) - annotated - [select for diffs] , Mon Mar 22
>> 16:05:48 2004 UTC (3 hours ago) by gerald
>> Branch: MAIN
>> CVS Tags: HEAD
>> Changes since 1.99: +6 -2 lines
>> Diff to previous 1.99
>> 
>> Handle null RADIUS attribute information without crashing.  Found by
>> Jonathan Heusser.
>
>Will this be in the upcoming release as well?
>
>-- 
>Tom
>
>    [ Part 2, "Digital signature"  Application/PGP-SIGNATURE  196bytes. ]
>    [ Unable to print this part. ]
>
>
>From trini@mvista.com Tue Mar 23 09:08:17 2004
>Date: Mon, 22 Mar 2004 12:30:39 -0700
>From: Tom Rini <trini@mvista.com>
>To: vendor-sec@lst.de
>Subject: Re: [vendor-sec] [jonny@drugphish.ch: Re: vulnerability in ethereal
>     0.10.2]
>
>On Mon, Mar 22, 2004 at 12:28:12PM -0700, Tom Rini wrote:
>
>> On Mon, Mar 22, 2004 at 11:07:00AM -0800, Matt Zimmerman wrote:
>> 
>> > Looks like a DoS; since we'll likely all be doing ethereal updates anyway...
>> > No CAN yet; this is public, so waiting for Mitre.
>> > 
>> > Trivial fix is here:
>> > 
>> > Revision 1.100 / (colorized) - annotated - [select for diffs] , Mon Mar 22
>> > 16:05:48 2004 UTC (3 hours ago) by gerald
>> > Branch: MAIN
>> > CVS Tags: HEAD
>> > Changes since 1.99: +6 -2 lines
>> > Diff to previous 1.99
>> > 
>> > Handle null RADIUS attribute information without crashing.  Found by
>> > Jonathan Heusser.
>> 
>> Will this be in the upcoming release as well?
>
>Nevermind, I see it listed in the advisory.
>
>-- 
>Tom
>
>    [ Part 2, "Digital signature"  Application/PGP-SIGNATURE  196bytes. ]
>    [ Unable to print this part. ]
>
>
>From mdz@debian.org Tue Mar 23 09:08:24 2004
>Date: Mon, 22 Mar 2004 11:33:15 -0800
>From: Matt Zimmerman <mdz@debian.org>
>To: vendor-sec@lst.de
>Subject: Re: [vendor-sec] [jonny@drugphish.ch: Re: vulnerability in ethereal
>     0.10.2]
>
>On Mon, Mar 22, 2004 at 12:28:12PM -0700, Tom Rini wrote:
>
>> On Mon, Mar 22, 2004 at 11:07:00AM -0800, Matt Zimmerman wrote:
>> 
>> > Looks like a DoS; since we'll likely all be doing ethereal updates anyway...
>> > No CAN yet; this is public, so waiting for Mitre.
>> > 
>> > Trivial fix is here:
>> > 
>> > Revision 1.100 / (colorized) - annotated - [select for diffs] , Mon Mar 22
>> > 16:05:48 2004 UTC (3 hours ago) by gerald
>> > Branch: MAIN
>> > CVS Tags: HEAD
>> > Changes since 1.99: +6 -2 lines
>> > Diff to previous 1.99
>> > 
>> > Handle null RADIUS attribute information without crashing.  Found by
>> > Jonathan Heusser.
>> 
>> Will this be in the upcoming release as well?
>
>I don't know; that is all the information I have.  It is fixed on CVS HEAD.
>
>-- 
> - mdz
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From mdz@debian.org Tue Mar 23 09:08:29 2004
>Date: Mon, 22 Mar 2004 12:24:27 -0800
>From: Matt Zimmerman <mdz@debian.org>
>To: vendor-sec@lst.de
>Subject: Re: [vendor-sec] Ethereal Advisory
>
>On Mon, Mar 22, 2004 at 05:35:58PM +0000, Mark J Cox wrote:
>
>> > Obviously the document is linked from their website and beside the
>> > fact that it lacks 3 overflows (the UCPs) it tells the users to
>> > upgrade to v0.10.3 which does not exist yet ...
>> 
>> So I gave a single name, CAN-2004-0176 to these issues.  However if and
>> only if 0.10.3 doesn't contain the three UCPs then we need a separate name
>> for those issues - use CAN-2004-0181 for them.
>
>So the upstream advisory lists these four items:
>
># Stefan Esser discovered thirteen buffer overflows in the following
># protocol dissectors: NetFlow, IGAP, EIGRP, PGM, IrDA, BGP, ISUP, and TCAP.
>
>These are CAN-2004-0176 assigned by you.
>
># A zero-length Presentation protocol selector could make Ethereal crash.
>
>This is unassigned as far as I know, if indeed it represents a vulnerability.
>
># Jonathan Heussser discovered that a carefully-crafted RADIUS packet could
># cause a crash.
>
>This is CAN-2004-0365 assigned by Mitre.
>
># A corrupt color filter file could cause a segmentation fault.
>
>I don't even know whether this is a vulnerability or not (ethereal
>advisories are my favorite).
>
>-- 
> - mdz
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From trini@mvista.com Tue Mar 23 09:08:59 2004
>Date: Mon, 22 Mar 2004 15:55:11 -0700
>From: Tom Rini <trini@mvista.com>
>To: Stefan Esser <s.esser@e-matters.de>
>Cc: vendor-sec@lst.de
>Subject: Re: [vendor-sec] Ethereal Advisory
>
>On Mon, Mar 22, 2004 at 06:13:20PM +0100, Stefan Esser wrote:
>
>[snip]
>> If you are running a version prior to 0.10.3 and you cannot upgrade, you can disable all of the protocol dissectors listed above by selecting Edit->Protocols... and deselecting them from the list. However, it is strongly recommended that you upgrade to 0.10.3. 
>
>... Edit->Preferences then select Protocols ...
>
>-- 
>Tom
>
>    [ Part 2, "Digital signature"  Application/PGP-SIGNATURE  196bytes. ]
>    [ Unable to print this part. ]
>
>
>From trini@mvista.com Tue Mar 23 09:09:04 2004
>Date: Mon, 22 Mar 2004 16:02:00 -0700
>From: Tom Rini <trini@mvista.com>
>To: Stefan Esser <s.esser@e-matters.de>
>Cc: vendor-sec@lst.de
>Subject: Re: [vendor-sec] Ethereal Advisory
>
>On Mon, Mar 22, 2004 at 03:55:11PM -0700, Tom Rini wrote:
>
>> On Mon, Mar 22, 2004 at 06:13:20PM +0100, Stefan Esser wrote:
>> 
>> [snip]
>> > If you are running a version prior to 0.10.3 and you cannot upgrade, you can disable all of the protocol dissectors listed above by selecting Edit->Protocols... and deselecting them from the list. However, it is strongly recommended that you upgrade to 0.10.3. 
>> 
>> ... Edit->Preferences then select Protocols ...
>
>Hell, that's not even right (unless this has all changed from 0.10.2),
>and should be Analyze -> Enabled Protocols, and click on each to
>disable.
>
>-- 
>Tom
>
>    [ Part 2, "Digital signature"  Application/PGP-SIGNATURE  196bytes. ]
>    [ Unable to print this part. ]
>

Actions: View

Attachments on bug 50449: 16420 | 16421 | 16422 | 17022