Bug 116943 – net-analyzer/ethereal GTP Dissector Denial of Service Vulnerability

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description ChazeFroy 2005-12-27 20:00:34 UTC]

Ethereal 0.10.14 has been released and it fixes three security vulnerabilities:

- The IRC dissector could go into an infinite loop. Versions affected: 0.10.13.
- The GTP dissector could go into an infinite loop. Versions affected: 0.9.1 to 0.10.13.
- iDefense found a buffer overflow in the OSPF dissector. Versions affected: 0.8.20 to 0.10.13.

[Comment 1 Sune Kloppenborg Jeppesen (RETIRED) 2005-12-28 04:35:45 UTC]

The buffer overflow was already fixed on bug #115030. The two infinite loop issues remain.

netmon please advise and bump as necessary.

[Comment 2 Thierry Carrez (RETIRED) 2005-12-28 07:51:15 UTC]

.

[Comment 3 Daniel Black (RETIRED) 2005-12-28 14:52:46 UTC]

ethereal-0.10.14 added

verified that OSPF code is fixed

IRC code is the same as 0.10.13-r2 so this is only a GTP dissector DoS.

I tend to vote no to a GLSA based on this.

[Comment 4 Mark Loeser (RETIRED) 2005-12-28 18:21:05 UTC]

x86 stable

[Comment 5 Markus Rothe (RETIRED) 2005-12-29 00:52:18 UTC]

stable on ppc64

[Comment 6 Simon Stelling (RETIRED) 2005-12-29 06:47:04 UTC]

amd64 stable

[Comment 7 Gustavo Zacarias (RETIRED) 2005-12-29 07:54:33 UTC]

sparc stable.

[Comment 8 Tobias Scherbaum (RETIRED) 2005-12-29 12:23:40 UTC]

ppc stable

[Comment 9 Fernando J. Pereda (RETIRED) 2005-12-30 08:43:12 UTC]

Stable on alpha

Cheers,
Ferdy

[Comment 10 Thierry Carrez (RETIRED) 2005-12-31 05:14:53 UTC]

I tend to vote no.

[Comment 11 Sune Kloppenborg Jeppesen (RETIRED) 2005-12-31 06:25:21 UTC]

I tend to vote NO too.

[Comment 12 Stefan Cornelius (RETIRED) 2006-01-02 13:11:00 UTC]

i'd say no, too

[Comment 13 Vic Fryzel (shellsage) (RETIRED) 2006-01-02 13:16:48 UTC]

I vote no.

[Comment 14 Stefan Cornelius (RETIRED) 2006-01-02 13:22:41 UTC]

ok, enough no-votes to close without glsa. ia64 shouldn't forget to stable.