Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 508506 (CVE-2014-2907)

Summary: <net-analyzer/wireshark-1.10.7 - RTP dissector crash (CVE-2014-2907)
Product: Gentoo Security Reporter: Jeroen Roovers (RETIRED) <jer>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: netmon
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://www.wireshark.org/security/wnpa-sec-2014-06.html
See Also: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9885
Whiteboard: B3 [glsa]
Package list:
Runtime testing required: ---

Description Jeroen Roovers (RETIRED) gentoo-dev 2014-04-23 14:00:31 UTC 
* [1]wnpa-sec-2014-06
       The RTP dissector could crash. ([2]Bug 9885)
       Versions affected: 1.10.0 to 1.10.6
       [3]CVE-2014-2907
Comment 1 Jeroen Roovers (RETIRED) gentoo-dev 2014-04-23 14:24:47 UTC 
Arch teams, please test and mark stable:
=net-analyzer/wireshark-1.10.7
Targeted stable KEYWORDS : alpha amd64 hppa ia64 ppc ppc64 sparc x86
Comment 2 Jeroen Roovers (RETIRED) gentoo-dev 2014-04-23 23:53:17 UTC 
Stable for HPPA.
Comment 3 Agostino Sarubbo gentoo-dev 2014-04-26 09:09:16 UTC 
amd64 stable
Comment 4 Agostino Sarubbo gentoo-dev 2014-04-27 09:09:05 UTC 
x86 stable
Comment 5 GLSAMaker/CVETool Bot gentoo-dev 2014-04-29 21:22:51 UTC 
CVE-2014-2907 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2907):
  The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP
  dissector in Wireshark 1.10.x before 1.10.7 does not properly update SRTP
  conversation data, which allows remote attackers to cause a denial of
  service (application crash) via a crafted packet.
Comment 6 Agostino Sarubbo gentoo-dev 2014-05-10 14:02:27 UTC 
ppc stable
Comment 7 Agostino Sarubbo gentoo-dev 2014-05-11 08:05:45 UTC 
ppc64 stable
Comment 8 Agostino Sarubbo gentoo-dev 2014-05-13 15:21:48 UTC 
ia64 stable
Comment 9 Agostino Sarubbo gentoo-dev 2014-05-14 16:11:56 UTC 
sparc stable
Comment 10 Agostino Sarubbo gentoo-dev 2014-05-17 13:51:05 UTC 
alpha stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 11 Yury German Gentoo Infrastructure gentoo-dev 2014-06-10 01:23:41 UTC 
Arches and Mainter(s), Thank you for your work.

Added to an existing GLSA request.
Comment 12 GLSAMaker/CVETool Bot gentoo-dev 2014-06-29 16:14:45 UTC 
This issue was resolved and addressed in
 GLSA 201406-33 at http://security.gentoo.org/glsa/glsa-201406-33.xml
by GLSA coordinator Mikle Kolyada (Zlogene).