Wireshark security issue

[Arthur Demchenkov]

It could be an enhancement. But I consider this critical.

Here's some info from Gentoo's ebuild:

With version 0.99.7, all function calls that require elevated privileges
have been moved out of the GUI to dumpcap. WIRESHARK CONTAINS OVER ONE
POINT FIVE MILLION LINES OF SOURCE CODE. DO NOT RUN THEM AS ROOT.

NOTE: To run wireshark as normal user you have to add yourself into
wireshark group. This security measure ensures that only trusted
users allowed to sniff your traffic.

Here's what I propose to do...

Before the installation:

groupadd -g 91 wireshark

After the installation:

chown -v root:wireshark /usr/bin/{tshark,dumpcap} &&
chmod -v 6550 /usr/bin/{tshark,dumpcap} &&

And to add this note at the end of installation...

Add the users you would like to the wireshark group:

usermod -a -G wireshark <username>

[willimm]

Also, there is a new version, 1.0.8.

Release notes are here:

​http://www.wireshark.org/docs/relnotes/wireshark-1.0.8.html

[Randy McMurchy]

Modified milestone from 6.4 to 6.5

[(none)]

Milestone 6.5 deleted

[Randy McMurchy]

Updated milestone to 6.7

[bdubbs@…]

Fixed at revision 9904.

[bdubbs@…]

Milestone current deleted