Debian Bug report logs - #342911
CVE-2005-3651: Buffer overflow in OSPF dissector

version graph

Package: ethereal; Maintainer for ethereal is (unknown);

Reported by: Moritz Muehlenhoff <jmm@inutil.org>

Date: Sun, 11 Dec 2005 17:33:10 UTC

Severity: important

Tags: security

Found in version ethereal/0.10.13-1

Fixed in version ethereal/0.10.13-1.1

Done: Frederic Peters <fpeters@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian Security Team <team@security.debian.org>, Frederic Peters <fpeters@debian.org>:
Bug#342911; Package ethereal. Full text and rfc822 format available.

Acknowledgement sent to Moritz Muehlenhoff <jmm@inutil.org>:
New Bug report received and forwarded. Copy sent to Debian Security Team <team@security.debian.org>, Frederic Peters <fpeters@debian.org>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Moritz Muehlenhoff <jmm@inutil.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: CVE-2005-3651: Buffer overflow in OSPF dissector
Date: Sun, 11 Dec 2005 18:16:21 +0100
Package: ethereal
Version: 0.10.13-1
Severity: important
Tags: security
Justification: user security hole

Another security problem has been discovered in Ethereal. This time it's
a buffer overflow in the OSPF dissector. Please see 
http://www.idefense.com/application/poi/display?id=349&type=vulnerabilities
for details. This has been assigned CVE-2005-3651.

Cheers,
        Moritz

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.14-2-686
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15@euro (charmap=ISO-8859-15)



Information forwarded to debian-bugs-dist@lists.debian.org, Frederic Peters <fpeters@debian.org>:
Bug#342911; Package ethereal. Full text and rfc822 format available.

Acknowledgement sent to Martin Schulze <joey@infodrom.org>:
Extra info received and forwarded to list. Copy sent to Frederic Peters <fpeters@debian.org>. Full text and rfc822 format available.

Message #10 received at 342911@bugs.debian.org (full text, mbox):

From: Martin Schulze <joey@infodrom.org>
To: Moritz Muehlenhoff <jmm@inutil.org>
Cc: Debian Bug Tracking System <342911@bugs.debian.org>
Subject: Re: Bug#342911: CVE-2005-3651: Buffer overflow in OSPF dissector
Date: Sun, 11 Dec 2005 18:42:40 +0100
Moritz Muehlenhoff wrote:
> Package: ethereal
> Version: 0.10.13-1
> Severity: important
> Tags: security
> Justification: user security hole
> 
> Another security problem has been discovered in Ethereal. This time it's
> a buffer overflow in the OSPF dissector. Please see 
> http://www.idefense.com/application/poi/display?id=349&type=vulnerabilities
> for details. This has been assigned CVE-2005-3651.

Thanks, already working on an update.

Regards,

	Joey

-- 
This is GNU/Linux Country.  On a quiet night, you can hear Windows reboot.

Please always Cc to me when replying to me on the lists.



Information forwarded to debian-bugs-dist@lists.debian.org, Frederic Peters <fpeters@debian.org>:
Bug#342911; Package ethereal. Full text and rfc822 format available.

Acknowledgement sent to Martin Schulze <joey@infodrom.org>:
Extra info received and forwarded to list. Copy sent to Frederic Peters <fpeters@debian.org>. Full text and rfc822 format available.

Message #15 received at 342911@bugs.debian.org (full text, mbox):

From: Martin Schulze <joey@infodrom.org>
To: Debian Bug Tracking System <342911@bugs.debian.org>
Subject: Re: Bug#342911: CVE-2005-3651: Buffer overflow in OSPF dissector
Date: Fri, 23 Dec 2005 18:41:18 +0100
[Message part 1 (text/plain, inline)]
Moritz Muehlenhoff wrote:
> Package: ethereal
> Version: 0.10.13-1
> Severity: important
> Tags: security
> Justification: user security hole
> 
> Another security problem has been discovered in Ethereal. This time it's
> a buffer overflow in the OSPF dissector. Please see 
> http://www.idefense.com/application/poi/display?id=349&type=vulnerabilities
> for details. This has been assigned CVE-2005-3651.

Frederic, attached is the patch we're using for the update in sarge,
basically the function body is exchanged (variable names adjusted and
struct adjusted).

Sorry, looks like I postponed this mail too long.

Regards,

	Joey

-- 
This is GNU/Linux Country.  On a quiet night, you can hear Windows reboot.

Please always Cc to me when replying to me on the lists.
[x (text/plain, attachment)]

Information forwarded to debian-bugs-dist@lists.debian.org, Frederic Peters <fpeters@debian.org>:
Bug#342911; Package ethereal. Full text and rfc822 format available.

Acknowledgement sent to Moritz Muehlenhoff <jmm@inutil.org>:
Extra info received and forwarded to list. Copy sent to Frederic Peters <fpeters@debian.org>. Full text and rfc822 format available.

Message #20 received at 342911@bugs.debian.org (full text, mbox):

From: Moritz Muehlenhoff <jmm@inutil.org>
To: Martin Schulze <joey@infodrom.org>
Cc: 342911@bugs.debian.org
Subject: Re: Bug#342911: CVE-2005-3651: Buffer overflow in OSPF dissector
Date: Sun, 25 Dec 2005 11:59:30 +0100
[Message part 1 (text/plain, inline)]
Martin Schulze wrote:
> Moritz Muehlenhoff wrote:
> > Package: ethereal
> > Version: 0.10.13-1
> > Severity: important
> > Tags: security
> > Justification: user security hole
> > 
> > Another security problem has been discovered in Ethereal. This time it's
> > a buffer overflow in the OSPF dissector. Please see 
> > http://www.idefense.com/application/poi/display?id=349&type=vulnerabilities
> > for details. This has been assigned CVE-2005-3651.
> 
> Frederic, attached is the patch we're using for the update in sarge,
> basically the function body is exchanged (variable names adjusted and
> struct adjusted).

Frederic wrote in another bug log that he's currently w/o sufficient internet
access. I've NMUed the sid version with the attached patch.

Cheers,
        Moritz
[CVE-2005-3651-nmu.diff (text/plain, attachment)]

Information forwarded to debian-bugs-dist@lists.debian.org, Frederic Peters <fpeters@debian.org>:
Bug#342911; Package ethereal. Full text and rfc822 format available.

Acknowledgement sent to Martin Schulze <joey@infodrom.org>:
Extra info received and forwarded to list. Copy sent to Frederic Peters <fpeters@debian.org>. Full text and rfc822 format available.

Message #25 received at 342911@bugs.debian.org (full text, mbox):

From: Martin Schulze <joey@infodrom.org>
To: Moritz Muehlenhoff <jmm@inutil.org>
Cc: 342911@bugs.debian.org
Subject: Re: Bug#342911: CVE-2005-3651: Buffer overflow in OSPF dissector
Date: Sun, 25 Dec 2005 12:54:11 +0100
Moritz Muehlenhoff wrote:
> Martin Schulze wrote:
> > Moritz Muehlenhoff wrote:
> > > Package: ethereal
> > > Version: 0.10.13-1
> > > Severity: important
> > > Tags: security
> > > Justification: user security hole
> > > 
> > > Another security problem has been discovered in Ethereal. This time it's
> > > a buffer overflow in the OSPF dissector. Please see 
> > > http://www.idefense.com/application/poi/display?id=349&type=vulnerabilities
> > > for details. This has been assigned CVE-2005-3651.
> > 
> > Frederic, attached is the patch we're using for the update in sarge,
> > basically the function body is exchanged (variable names adjusted and
> > struct adjusted).
> 
> Frederic wrote in another bug log that he's currently w/o sufficient internet
> access. I've NMUed the sid version with the attached patch.

Frederic wrote in another bug log that he's currently w/o sufficient internet
access. I've NMUed the sid version with the attached patch.

Great!  Thanks a lot.

Regards,

	Joey

-- 
This is GNU/Linux Country.  On a quiet night, you can hear Windows reboot.

Please always Cc to me when replying to me on the lists.



Bug marked as fixed in version 0.10.13-1.1, send any further explanations to Moritz Muehlenhoff <jmm@inutil.org> Request was from Frederic Peters <fpeters@debian.org> to control@bugs.debian.org. Full text and rfc822 format available.

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 24 Jun 2007 14:31:24 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Fri Apr 18 16:44:32 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.