Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 381551 (CVE-2011-3266) - <net-analyzer/wireshark-1.4.9 IKEv1: proto_tree_add_item() DoS (CVE-2011-3266)
Summary: <net-analyzer/wireshark-1.4.9 IKEv1: proto_tree_add_item() DoS (CVE-2011-3266)
Status: RESOLVED FIXED
Alias: CVE-2011-3266
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [glsa]
Keywords:
Depends on:
Blocks: CVE-2011-3360
  Show dependency tree
 
Reported: 2011-09-02 11:07 UTC by GLSAMaker/CVETool Bot
Modified: 2011-10-09 20:02 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2011-09-02 11:07:22 UTC
CVE-2011-3266 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3266):
  The proto_tree_add_item function in Wireshark 1.6.1, when the IKEv1 protocol
  dissector is used, allows user-assisted remote attackers to cause a denial
  of service (infinite loop) via vectors involving a malformed IKE packet and
  many items in a tree.
Comment 1 Agostino Sarubbo gentoo-dev 2011-09-09 09:46:41 UTC
1.4.9 is out.
Comment 2 Peter Volkov (RETIRED) gentoo-dev 2011-09-12 18:51:52 UTC
wireshark-1.4.9 is in the tree. Arch teams, please, stabilize.
Comment 3 Agostino Sarubbo gentoo-dev 2011-09-12 20:02:43 UTC
@Peter (not a block, only reminder):

 inherit.autotools             2
   net-analyzer/wireshark/wireshark-1.4.8.ebuild: no eauto* function called
   net-analyzer/wireshark/wireshark-1.4.9.ebuild: no eauto* function called

And you should drop ".la" files


AMD64 OK
Comment 4 Andreas Schürch gentoo-dev 2011-09-13 10:30:07 UTC
x86 stable.
Comment 5 Agostino Sarubbo gentoo-dev 2011-09-13 13:34:18 UTC
(In reply to comment #4)
> x86 stable.

Do not forget to remove arches from CC. ;)
Comment 6 Elijah "Armageddon" El Lazkani (amd64 AT) 2011-09-14 02:50:16 UTC
amd64: pass
Comment 7 Jeroen Roovers gentoo-dev 2011-09-14 15:35:33 UTC
Stable for HPPA.
Comment 8 Tony Vroon gentoo-dev 2011-09-16 12:11:35 UTC
+  16 Sep 2011; Tony Vroon <chainsaw@gentoo.org> wireshark-1.4.9.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo &
+  Elijah "Armageddon" El Lazkani in security bug #381551.
Comment 9 Raúl Porcel (RETIRED) gentoo-dev 2011-09-17 11:34:48 UTC
alpha/ia64/sparc stable
Comment 10 Kacper Kowalik (Xarthisius) (RETIRED) gentoo-dev 2011-09-27 17:12:12 UTC
ppc/ppc64 stable, last arch done
Comment 11 Tim Sammut (RETIRED) gentoo-dev 2011-09-27 17:14:23 UTC
Thanks, everyone. GLSA Vote: no.
Comment 12 GLSAMaker/CVETool Bot gentoo-dev 2011-10-09 20:01:24 UTC
This issue was resolved and addressed in
 GLSA 201110-02 at http://security.gentoo.org/glsa/glsa-201110-02.xml
by GLSA coordinator Alex Legler (a3li).
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2011-10-09 20:02:17 UTC
This issue was resolved and addressed in
 GLSA 201110-02 at http://security.gentoo.org/glsa/glsa-201110-02.xml
by GLSA coordinator Alex Legler (a3li).