Your message dated Thu, 10 Mar 2005 05:02:12 -0500
with message-id <[EMAIL PROTECTED]>
and subject line Bug#298771: fixed in ethereal 0.10.9-2
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 9 Mar 2005 21:48:03 +0000
>From [EMAIL PROTECTED] Wed Mar 09 13:48:03 2005
Return-path: <[EMAIL PROTECTED]>
Received: from kitenet.net [64.62.161.42] (postfix)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1D992B-0002dF-00; Wed, 09 Mar 2005 13:48:03 -0800
Received: from dragon.kitenet.net (unknown [66.168.94.177])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(Client CN "Joey Hess", Issuer "Joey Hess" (verified OK))
by kitenet.net (Postfix) with ESMTP id 92A4918064
for <[EMAIL PROTECTED]>; Wed, 9 Mar 2005 21:48:02 +0000 (GMT)
Received: by dragon.kitenet.net (Postfix, from userid 1000)
id A576A6E352; Wed, 9 Mar 2005 16:50:58 -0500 (EST)
Date: Wed, 9 Mar 2005 16:50:57 -0500
From: Joey Hess <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: buffer overflow in dissect_a11_radius() (CAN-2005-0699)
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="LQksG6bCIzRHxTLp"
Content-Disposition: inline
X-Reportbug-Version: 3.8
User-Agent: Mutt/1.5.6+20040907i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
--LQksG6bCIzRHxTLp
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Package: ethereal
Version: 0.10.9-1
Severity: grave
Tags: security
There is remote buffer overflow vulnerability in Ethereal dissector for=
=20
CDMA2000 A11 packets. Vulnerability is located in dissect_a11_radius() fu=
nction=20
in packet-3g-a11.c used for RADIUS authentication dissection. Number of b=
ytes=20
that will be copied from packet to buffer in stack is taken from packet i=
tself.=20
16 bytes are reserved for that buffer, and string length can be up to 256=
bytes=20
(unsigned char), so is possible to overflow local variables and return ad=
dress.=20
http://www.securityfocus.com/archive/1/392659
A fixed version should be released upstream on March 10th. I think a fix
is already available in upstream svn, based on this page:
http://www.securityfocus.com/bid/12759/solution/
--=20
see shy jo
--LQksG6bCIzRHxTLp
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCL2/Bd8HHehbQuO8RAjb+AJ9GMaxXOOCNclJnQKJDxhN8qZHoWACeO5tf
y4cJyiVDbMXLoDli2KCplsI=
=jmnb
-----END PGP SIGNATURE-----
--LQksG6bCIzRHxTLp--
---------------------------------------
Received: (at 298771-close) by bugs.debian.org; 10 Mar 2005 10:08:03 +0000
>From [EMAIL PROTECTED] Thu Mar 10 02:08:03 2005
Return-path: <[EMAIL PROTECTED]>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1D9KaJ-0005IR-00; Thu, 10 Mar 2005 02:08:03 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1D9KUe-0003Kd-00; Thu, 10 Mar 2005 05:02:12 -0500
From: Frederic Peters <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.55 $
Subject: Bug#298771: fixed in ethereal 0.10.9-2
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Thu, 10 Mar 2005 05:02:12 -0500
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Source: ethereal
Source-Version: 0.10.9-2
We believe that the bug you reported is fixed in the latest version of
ethereal, which is due to be installed in the Debian FTP archive:
ethereal-common_0.10.9-2_i386.deb
to pool/main/e/ethereal/ethereal-common_0.10.9-2_i386.deb
ethereal-dev_0.10.9-2_i386.deb
to pool/main/e/ethereal/ethereal-dev_0.10.9-2_i386.deb
ethereal_0.10.9-2.diff.gz
to pool/main/e/ethereal/ethereal_0.10.9-2.diff.gz
ethereal_0.10.9-2.dsc
to pool/main/e/ethereal/ethereal_0.10.9-2.dsc
ethereal_0.10.9-2_i386.deb
to pool/main/e/ethereal/ethereal_0.10.9-2_i386.deb
tethereal_0.10.9-2_i386.deb
to pool/main/e/ethereal/tethereal_0.10.9-2_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Frederic Peters <[EMAIL PROTECTED]> (supplier of updated ethereal package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Thu, 10 Mar 2005 10:25:08 +0100
Source: ethereal
Binary: ethereal ethereal-dev tethereal ethereal-common
Architecture: source i386
Version: 0.10.9-2
Distribution: unstable
Urgency: high
Maintainer: Frederic Peters <[EMAIL PROTECTED]>
Changed-By: Frederic Peters <[EMAIL PROTECTED]>
Description:
ethereal - network traffic analyzer
ethereal-common - network traffic analyser (common files)
ethereal-dev - network traffic analyser (development tools)
tethereal - network traffic analyzer (console)
Closes: 298771
Changes:
ethereal (0.10.9-2) unstable; urgency=high
.
* Backported packet-3g-a11.c from upstream subversion trunk.
(fixes buffer overflows in 3G-A11 dissector)
(CAN-2005-0699 (under review)) (closes: #298771)
Files:
1e068b7187a29d8ab3abae904916005e 840 net optional ethereal_0.10.9-2.dsc
b4fcba900eedaac910627b4329665803 621567 net optional ethereal_0.10.9-2.diff.gz
90dabba87cc2445dd4f8fbbd0b1495ce 4313216 net optional
ethereal-common_0.10.9-2_i386.deb
16d5e18de9bcdf7d042eb790c7cb862b 401656 net optional ethereal_0.10.9-2_i386.deb
e36c2ff174fba85b4727aa6dfb2065ad 86552 net optional tethereal_0.10.9-2_i386.deb
4b10f026d423c6f24f8e6467fd44aa3b 150620 devel optional
ethereal-dev_0.10.9-2_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCMBSkoR3LsWeD7V4RAselAJ4l/Sx5SF1uieC+oTWfEyGV6N9uawCfSMBg
94XXM1jsxIosE1yD1E+5Gs0=
=meW8
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
