RHSA-2008:0890: Moderate: wireshark security update
Wireshark is a program for monitoring network traffic. Wireshark waspreviously known as Ethereal.Multiple buffer overflow flaws were found in Wireshark. If Wireshark reada malformed packet off a network, it could crash or, possibly, executearbitrary code as the user running Wireshark. (CVE-2008-3146)Several denial of service flaws were found in Wireshark. Wireshark couldcrash or stop responding if it read a malformed packet off a network, oropened a malformed dump file. (CVE-2008-1070, CVE-2008-1071, CVE-2008-1072,CVE-2008-1561, CVE-2008-1562, CVE-2008-1563, CVE-2008-3137, CVE-2008-3138,CVE-2008-3141, CVE-2008-3145, CVE-2008-3932, CVE-2008-3933, CVE-2008-3934)Additionally, this update changes the default Pluggable AuthenticationModules (PAM) configuration to always prompt for the root password beforeeach start of Wireshark. This avoids unintentionally running Wireshark withroot privileges.Users of wireshark should upgrade to these updated packages, which containWireshark version 1.0.3, and resolve these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2008:0890?
The severity of RHSA-2008:0890 is significant due to multiple buffer overflow flaws that could lead to application crashes or arbitrary code execution.
How do I fix RHSA-2008:0890?
You can fix RHSA-2008:0890 by upgrading Wireshark to version 1.0.3-4.el5_2 or higher.
What versions of Wireshark are affected by RHSA-2008:0890?
RHSA-2008:0890 affects Wireshark versions prior to 1.0.3-4.el5_2 as well as older versions in the el4 and el5 series.
What are the risks of not addressing RHSA-2008:0890?
Not addressing RHSA-2008:0890 could leave your system vulnerable to crashes and potential arbitrary code execution from malformed packets.
Is there any workaround for RHSA-2008:0890 if I cannot upgrade immediately?
There is no specific workaround for RHSA-2008:0890, so upgrading as soon as possible is recommended to mitigate risks.