$Id: NEWS 19757 2006-10-31 17:45:15Z gerald $
== October 31, 2006
Wireshark 0.99.4 has been released.
------------------------------------------------------------------
What is Wireshark?
Wireshark is the world's most popular network protocol analyzer.
It is used for troubleshooting, analysis, development, and
education.
What's New
Bug Fixes
The following vulnerabilities have been fixed. See the [1]security
advisory for details and a workaround.
o The HTTP dissector could crash. (Bugs [2]1050 and [3]1079)
Versions affected: 0.99.3.
[4]CVE-2006-5468
o The LDAP dissector (and possibly others) could crash. (Bug
[5]1054)
Versions affected: 0.99.3.
[6]CVE-2006-5740
o The XOT dissector could attempt to allocate a large amount of
memory and crash. (Bug [7]1133)
Versions affected: 0.9.8 to 0.99.3.
[8]CVE-2006-4805
o The WBXML dissector could crash. (Bug [9]1134)
Versions affected: 0.10.11 to 0.99.3.
[10]CVE-2006-5469
o The MIME Multipart dissector was susceptible to an off-by-one
error. (Bug [11]1135)
Versions affected: 0.10.1 to 0.99.3.
[12]CVE-2006-4574
o If AirPcap support was enabled, parsing a WEP key could
sometimes cause a crash.
Versions affected: 0.99.3.
The following bugs have been fixed:
o The file set dialog could grow excessively large. ([13]Bug
331)
o Trying to save flow data may crash Wireshark. ([14]Bug 396)
o It may not be possible to re-order coloring rules under
Windows. ([15]Bug 699)
o Printing each packet to a new page didn't work under Windows.
([16]Bug 707)
o The personal hosts configuration file wasn't being parsed
correctly. ([17]Bug 795)
o "Save as" to an existing file wasn't allowed. ([18]Bug 927)
o The SNMP dissector was not handling 64-bit counters properly.
([19]Bug 1047)
o Wireshark and TShark would fail to start under Windows while
trying to acquire a crypto context. ([20]Bug 1096)
o The HTTP content-length field was a string instead of an
integer. ([21]Bug 1109)
o Invalid characters could show up in PDML output. ([22]Bug
1110)
New and Updated Features
The following features are new (or have been significantly
updated) since the last release:
o [23]AirPcap, support (which provides raw mode capture under
Windows) has been enhanced to allow capturing on multiple
AirPcap adapters simultaneously using the Multi-Channel
Aggregator.
o VoIP call playback has been enhanced. If Wireshark is linked
with the PortAudio library, you can play back G.711
conversations. This feature is present in the standard Windows
installer.
o The capture interface dialog display has been enhanced.
o The "Save" button has been removed from the "Ok" / "Apply" /
"Cancel" button group in the following dialogs:
o Edit/Preferences
o View/Coloring Rules
o Capture/Capture Filters
o Analyze/Display Filters
o Analyze/Enabled Protocols
If you're fond of the "Save" button it can be resurrected in
the User Interface preferences.
o Reading from stdin ("-i -") now works under Windows.
o Expert analysis has been improved.
o Wireshark now supports USB as a media type. If you're running
a Linux distribution with version 2.6.11 of the kernel or
greater and you have the usbmon module enabled and you have a
recent CVS version of libpcap (post-0.9.5) installed you can
also do live captures. More details can be found at the
[24]USB capture setup page on the wiki.
o The number of WEP keys that the user can specify in the IEEE
802.11 protocol preferences has been increased from 4 to 64.
New Protocol Support
Enea LINX, Ethernet Powerlink (v1 and v2), H.248 Q.1950 Annex A,
Linux pktgen, MP2T, NEWMAIL, PNG, SCSI OSD, UDLD, UMTS FP, USB,
WLCCP, WZCSVC
Updated Protocol Support
3Com NJACK, 802.11, ACSE, AH, ALCAP, ANSI MAP, ATM, ASN.1, BACapp,
BER, BGP, BSSAP, Camel, Catapult DCT2000, CFlow, CLNP, Common
Windows networking, DAP, DCERPC (DCERPC, ATSVC, DFS, EFS, EPM,
EVENTLOG, INITSHUTDOWN, MAPI, NT, PIPE, SAMR, SPOOLSS, SRVSVC,
SVCCTL, WINREG), DCOM (DCOM, CBA-ACCO, SYSACT), DIAMETER, DISP,
DNS, DOP, DSP, ESP, Ethernet, FC, FCP, GSM A, GSM MAP, GSM SMS,
GSSAPI, GTP, H.225, H.245, H.248, HTTP, ICQ, IKE, ISAKMP, iSCSI,
ISUP, IUUP, Kerberos 4, LAP-D, LDAP, LLC, LogotypeCertExtn,
MEGACO, MIME Multipart, MIP6, MMS, MSRP, MTP3, NCP, NDMP, NDPS,
NFS, NTP, OSI, PER, PN-MRP, PPP, 19154Q.931, RADIUS, Redback, RPC,
RTCP, RTP, SCCP, SCSI, SDP, SIP, SMB, SMRSE, SNMP, SSL, STANAG
5066, STP, TCAP, TCP, TFTP, TIPC, UDP, UMA, VLAN, VNC, VRRP,
X.509ce X11, YMSG, WTLS
Removed Protocols
The CISCOWL dissector has been superseded by WLCCP.
New and Updated Capture File Support
Catapult DCT2000, EyeSDN, iSeries
Getting Wireshark
Wireshark source code and installation packages are available from
the [25]download page on the main web site.
Vendor-supplied Packages
Most Linux and Unix vendors supply their own Wireshark packages.
You can usually install or upgrade Wireshark using the package
management system specific to that platform. A list of third-party
packages can be found on the [26]download page on the Wireshark
web site.
File Locations
Wireshark and TShark look in several different locations for
preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
These locations vary from platform to platform. You can use
About->Folders to find the default locations on your system.
Known Problems
On Windows systems the packet list scroll bar can sometimes
disappear or become unusable. Until the problem is fixed you can
work around it by resizing the packet list or the main window.
([27]Bug 220)
The Filter button is nonfunctional in the file dialogs under
Windows. ([28]Bug 942)
Getting Help
Community support is available on the wireshark-users mailing
list. Subscription information and archives for all of Wireshark's
mailing lists can be found on [29]the web site.
Commercial support, training, and development services are
available from [30]CACE Technologies.
Frequently Asked Questions
A complete FAQ is available on the [31]Wireshark web site.
References
Visible links
1. http://www.wireshark.org/security/wnpa-sec-2006-02.html
2. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1050
3. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1079
4. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5468
5. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1054
6. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5740
7. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1133
8. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4805
9. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1134
10. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5469
11. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1135
12. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4574
13. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=331
14. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=396
15. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=699
16. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=707
17. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=795
18. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=927
19. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1047
20. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1096
21. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1109
22. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1110
23. http://www.cacetech.com/products/airpcap.htm
24. http://wiki.wireshark.org/CaptureSetup/USB
25. http://www.wireshark.org/download.html
26. http://www.wireshark.org/download.html#otherplat
27. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=220
28. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=942
29. http://www.wireshark.org/lists/
30. http://www.cacetech.com/
31. http://www.wireshark.org/faq.html
