[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1109141428170.18631@faron.mitre.org>
Date: Wed, 14 Sep 2011 14:35:54 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: Josh Bressers <bressers@...hat.com>
cc: oss-security@...ts.openwall.com, Gerald Combs <gerald@...eshark.org>,
cve-assign@...re.org
Subject: Re: CVE Request: Multiple issues fixed in wireshark
1.6.2
> Are the below worth assigning CVE ids to? The advisory seems to suggest
> they are crash only fixes. Do those deserve CVE IDs? I know we've been
> fairly generous with wireshark in the past, but I'm wondering if we need
> to draw a line somewhere.
Crash-only issues are always/typically worth a CVE when it can prevent a
product from working in a security context. Wireshark monitors network
traffic, sometimes live; therefore, in some reasonable/common usage
scenarios, attackers can cause a crash and prevent network activities from
being detected.
We apply similar logic in forensics and other scenarios. Therefore a CVE
is needed for both wnpa-sec-2011-12 (crash reading live packets) as well
as wnpa-sec-2011-14 (by only reading a packet trace file) - in the latter,
analysis of a packet trace could be hampered/delayed because the
investigator can't use the product without it crashing.
Wireshark does not get any more "preference" than any other tool, except
indirectly because it gets more attention.
- Steve
On Wed, 14 Sep 2011, Josh Bressers wrote:
> ----- Original Message -----
>
>> 2. Wireshark Lua script execution vulnerability
>> http://www.wireshark.org/security/wnpa-sec-2011-15.html
>> https://bugzilla.redhat.com/show_bug.cgi?id=737784
>
> Use CVE-2011-3360 for the above.
>
>
>>
>> 1, Wireshark CSN.1 dissector vulnerability
>> http://www.wireshark.org/security/wnpa-sec-2011-16.html
>> https://bugzilla.redhat.com/show_bug.cgi?id=737783
>>
>> 3. Wireshark buffer exception handling vulnerability
>> http://www.wireshark.org/security/wnpa-sec-2011-14.html
>> https://bugzilla.redhat.com/show_bug.cgi?id=737785
>>
>> 4. Wireshark OpenSafety dissector vulnerability
>> http://www.wireshark.org/security/wnpa-sec-2011-12.html
>> https://bugzilla.redhat.com/show_bug.cgi?id=737787
>>
>
> Thanks.
>
> --
> JB
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
