Bug 62183 (CVE-2004-0507) - VUL-0: CVE-2004-0507: ethereal: missed patches for security problems in ethereal
Summary: VUL-0: CVE-2004-0507: ethereal: missed patches for security problems in ethereal
Status: RESOLVED FIXED
Alias: CVE-2004-0507
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: All Linux
: P3 - Medium : Major
Target Milestone: ---
Assignee: Thomas Biege
QA Contact: Security Team bot
URL:
Whiteboard: CVE-2004-0507: CVSS v2 Base Score: 10...
Keywords:
Depends on:
Blocks:
 
Reported: 2004-10-13 16:34 UTC by Ludwig Nussel
Modified: 2021-09-26 10:33 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ludwig Nussel 2004-10-13 16:34:45 UTC 
Looks like we missed some security updates for ethereal:

http://www.ethereal.com/appnotes/enpa-sa-00014.html

CAN-2004-0504
CAN-2004-0505
CAN-2004-0506
CAN-2004-0507

The last one is a buffer overflow, possibly allowing code execution.
Comment 1 Petr Ostadal 2004-10-20 19:30:20 UTC 
I looking in others distributions and all make version update from
ethereal-0.10.3 to ethereal-0.10.4. 

I try find problematic code in CVS, but it will take a lot of time, because the
changes doesn't describe any security problem ;( and it is hard to detect what
is normal bug, new feature or security bug.

Can I make version update for old distributions (in all we have ethereal-0.10.3) ?
Comment 2 Ludwig Nussel 2004-10-20 20:16:19 UTC 
We'd need to ask the project managers. 94000 lines of diff between the 
versions is quite large so this is not just a bugfix release. Those dissectors 
are all in separate files right? Maybe it's possible to upgrade only the 
affected files. Does the cvs log on them help (or cvsps)?
Comment 3 Marcus Meissner 2004-10-20 20:24:57 UTC 
We did version upgrades for ethereal in former updates too apparently, even 
for SLES 8. 
 
ethereal is a leafpackage, so it is mostly harmless to do so. 
 
I think we can do the same here.
Comment 4 Petr Ostadal 2004-10-20 20:34:43 UTC 
Fedora upgraded "affected files" (patch has 6844 lines), but is hard to say (and
 cvs log doesn't help much) if all affected files was included.
Comment 5 Thomas Biege 2004-11-18 00:24:29 UTC 
Hi Petr, 
do you have news for this issue?
Comment 6 Petr Ostadal 2004-11-18 18:41:43 UTC 
Sorry, I haven't seen any decision of project managers and mail from kukuk you read.
Comment 7 Thomas Biege 2004-11-18 20:02:06 UTC 
ok, thought there were some communication in the background...
Comment 8 Thomas Biege 2004-11-18 22:21:17 UTC 
as you read in the email... the gods have spoken.
Comment 9 Petr Ostadal 2004-11-19 18:34:54 UTC 
;), yes I trying prepare patch...
Comment 10 Marcus Meissner 2004-11-22 20:21:28 UTC 
Ralf Flaxa wrote: 
 
On Thu, Nov 18, 2004 at 01:04:48PM +0100, Thomas Biege wrote: 
> > > > 
> > > > I see possible problems with updates if we make a version update, 
> > > > ethereal has a long list of requirements... 
> 
> Is this an official decission or will we get any feedback from the 
> project managers too? 
 
Nobody did object, so this is the decision. 
Rationale: 
 
Rule 1: We do not do any version updates during maintenance 
Rule 2: We may do exceptions if backporting is impossible 
        or an unreasonable effort 
Rule 3: We will definitely NOT do a version update if this will 
        likely cause additional dependency trouble in the future 
 
So Rule 3 hits here. 
Feel free to apply these rules in similar cases. 
 
        Ralf
Comment 11 Petr Ostadal 2004-11-24 22:29:14 UTC 
I fixed and submited ethereal for following affected distributions: sles8, 8.2,
9.0, 9.1 .
Comment 12 Thomas Biege 2004-11-25 19:51:35 UTC 
Thank you. I'll submit the patchinfo files ASAP.
Comment 13 Thomas Biege 2004-11-25 20:10:56 UTC 
Petr, 
sles9 is not affected?
Comment 14 Petr Ostadal 2004-11-25 20:15:11 UTC 
Sles9 is affected too (9.1 and sles9 used same sources).
Comment 15 Thomas Biege 2004-11-25 20:28:09 UTC 
ok! 
 
submitted patchinfo files: 
/work/src/done/PATCHINFO/patchinfo-box.ethereal 
/work/src/done/PATCHINFO/patchinfo.ethereal
Comment 16 Michael Schröder 2004-11-26 02:15:42 UTC 
If 9.2 is not affected why is it listed in the patchinfo file?
Comment 17 Thomas Biege 2004-11-26 17:39:44 UTC 
my mistake. it's removed now.
Comment 18 Thomas Biege 2004-12-01 17:35:29 UTC 
packages were approved
Comment 19 Thomas Biege 2009-10-13 19:53:20 UTC 
CVE-2004-0507: CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)