Full Disclosure mailing list archives
OFFTOPIC Re: OpenLinux: Multiple vulnerabilities have reported in Ethereal 0.9.12 OFFTOPIC
From: "Kurt Seifried" <listuser () seifried org>
Date: Mon, 10 Nov 2003 21:47:38 -0700
OFFTOPIC The last three were only fixed recently (like a week ago). I'm sorry but Ethereal is not a critical package. To compromise a remote system via this you'd have to know they run Ethereal with the vulnerable protocol dissectors enabled, or send them a malicious packet capture to analyze. This is not a real concern for most production systems (and based on Ethereal's extremely poor security history admins should know better then to run it as root). I don't blame them for holding off on an update (or simply putting it on the back burner), it's of minor consequence to the vaste majority of users. Vendors have finite resources, they have to allocate them appropriately, for most this does not mean ethereal. News at 9: Debian fixes epic4 IRC client, flaws originally fixed in May of 2003. End of world film at 11. I suppose we should castigate Debian for placing the a huge number of users at risk via a remote flaw in it. Or maybe not. Kurt Seifried, kurt () seifried org A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://seifried.org/security/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- OpenLinux: Multiple vulnerabilities have reported in Ethereal 0.9.12 security (Nov 07)
- Re: OpenLinux: Multiple vulnerabilities have reported in Ethereal 0.9.12 Valdis . Kletnieks (Nov 10)
- OFFTOPIC Re: OpenLinux: Multiple vulnerabilities have reported in Ethereal 0.9.12 OFFTOPIC Kurt Seifried (Nov 10)
- Re: OFFTOPIC Re: OpenLinux: Multiple vulnerabilities have reported in Ethereal 0.9.12 OFFTOPIC Valdis . Kletnieks (Nov 10)
- OFFTOPIC Re: OpenLinux: Multiple vulnerabilities have reported in Ethereal 0.9.12 OFFTOPIC Kurt Seifried (Nov 10)
- Re: OpenLinux: Multiple vulnerabilities have reported in Ethereal 0.9.12 Valdis . Kletnieks (Nov 10)