<?xml version="1.0"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [

<!-- $Id: release-notes.xml 36110 2011-03-01 16:55:04Z gerald $ -->

<!--
DOCUMENT SECTION
-Use this section to encode all document information
-->

<!--
Wireshark Info
-->
  <!ENTITY WiresharkCurrentVersion "1.4.4">

]>

<article>
  <title>Wireshark &WiresharkCurrentVersion; Release Notes</title>

  <section id="WhatIs"><title>What is Wireshark?</title>
    <para>
      Wireshark is the world's most popular network protocol analyzer.  It
      is used for troubleshooting, analysis, development and education.
    </para>
  </section>

  <section id="WhatsNew"><title>What's New</title>
    <section id="BugFixes"><title>Bug Fixes</title>

    <para>

      The following vulnerabilities have been fixed. See the
      <ulink url="http://www.wireshark.org/security/wnpa-sec-2011-04.html">security advisory</ulink> for details and a workaround.

      <itemizedlist>

        <listitem>
          <para>
            Huzaifa Sidhpurwala of the Red Hat Security Response Team discovered
            that Wireshark could free an uninitialized pointer while reading a
            malformed pcap-ng file.
            <!-- Fixed in trunk: r35791 -->
            <!-- Fixed in trunk-1.4: r35792 -->
            <!-- Fixed in trunk-1.2: r35793 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5652">Bug
            5652</ulink>)
          </para>
          <para>Versions affected: 1.2.0 to 1.2.14 and 1.4.0 to 1.4.3.</para>
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0538">CVE-2011-0538</ulink>
          </para>
        </listitem>

        <listitem>
          <para>
            Huzaifa Sidhpurwala of the Red Hat Security Response Team discovered
            that a large packet length in a pcap-ng file could crash Wireshark.
            <!-- Fixed in trunk: r35855 -->
            <!-- Fixed in trunk-1.4: r35857 -->
            <!-- Fixed in trunk-1.2: r35858 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5661">Bug
            5661</ulink>)
          </para>
          <para>Versions affected: 1.2.0 to 1.2.14 and 1.4.0 to 1.4.3.</para>
          <!--
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-????">CVE-2011-????</ulink>
          </para>
          -->
        </listitem>

        <listitem>
          <para>
            Wireshark could overflow a buffer while reading a Nokia DCT3
            trace file.
            <!-- Fixed in trunk: r35953 -->
            <!-- Fixed in trunk-1.4: r36050 -->
            <!-- Fixed in trunk-1.2: r36051 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5661">Bug
            5661</ulink>)
          </para>
          <para>Versions affected: 1.2.0 to 1.2.14 and 1.4.0 to 1.4.3.</para>
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0713">CVE-2011-0713</ulink>
          </para>
        </listitem>

        <listitem>
          <para>
            Paul Makowski working for SEI/CERT discovered that Wireshark on 32
            bit systems could crash while reading a malformed 6LoWPAN packet.
            <!-- Fixed in trunk: r36037 -->
            <!-- Fixed in trunk-1.4: r36036 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5661">Bug
            5661</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.3.</para>
          <!--
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-????">CVE-2011-????</ulink>
          </para>
          -->
        </listitem>

        <listitem>
          <para>
            joernchen of Phenoelit discovered that the LDAP and SMB dissectors
            could overflow the stack.
            <!-- Fixed in trunk: r36029 -->
            <!-- Fixed in trunk-1.4: r36053 -->
            <!-- Fixed in trunk-1.2: r36054 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5717">Bug
            5717</ulink>)
          </para>
          <para>Versions affected: 1.2.0 to 1.2.14 and 1.4.0 to 1.4.3. (Prior versions including 1.0.x are also affected.)</para>
          <!--
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-????">CVE-2011-????</ulink>
          </para>
          -->
        </listitem>

        <listitem>
          <para>
            Xiaopeng Zhang of Fortinet's Fortiguard Labs discovered that large
            LDAP Filter strings can consume excessive amounts of memory.
            <!-- Fixed in trunk: r36101 -->
            <!-- Fixed in trunk-1.4: r36102 -->
            <!-- Fixed in trunk-1.2: r36103 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5732">Bug
            5732</ulink>)
          </para>
          <para>Versions affected: 1.2.0 to 1.2.14 and 1.4.0 to 1.4.3. (Prior versions including 1.0.x are also affected.)</para>
          <!--
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-????">CVE-2011-????</ulink>
          </para>
          -->
        </listitem>

      </itemizedlist>

    </para>

    <para>

    The following bugs have been fixed:

      <itemizedlist>

<!-- Sort by bug # -->
<!--
        <listitem><para>
          Wireshark can contribute to ennui in adolescent rats.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=0000">Bug
          0000</ulink>)
        </para></listitem>
-->
        <listitem><para>
          A TCP stream would not always be recognized as the same stream.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2907">Bug
          2907</ulink>)
        </para></listitem>

        <listitem><para>
          Wireshark Crashing by pressing 2 Buttons.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4645">Bug
          4645</ulink>)
        </para></listitem>

        <listitem><para>
          A crash can occur in the NTLMSSP dissector.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5157">Bug
          5157</ulink>)
        </para></listitem>

        <listitem><para>
          The column texts from a Lua dissector could be mangled.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5326">Bug
          5326</ulink>)
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5630">Bug
          5630</ulink>)
        </para></listitem>

        <listitem><para>
          Corrections to ANSI MAP ASN.1 specifications.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5584">Bug
          5584</ulink>)
        </para></listitem>

        <listitem><para>
          When searching in packet bytes, the field and bytes are not immediately shown.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5585">Bug
          5585</ulink>)
        </para></listitem>

        <listitem><para>
          Malformed Packet: ULP reported when dissecting ULP SessionID PDU.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5593">Bug
          5593</ulink>)
        </para></listitem>

        <listitem><para>
          Wrong IEI in container of decode_gtp_mm_cntxt.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5598">Bug
          5598</ulink>)
        </para></listitem>

        <listitem><para>
          Display filter does not work for expressions of type BASE_DEC, BASE_DEC_HEX and BASE_HEX_DEC.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5606">Bug
          5606</ulink>)
        </para></listitem>

        <listitem><para>
          NTLMSSP dissector may fail to compile due to space embedded in C comment delimiters.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5614">Bug
          5614</ulink>)
        </para></listitem>

        <listitem><para>
          Allow for name resolution of link-scope and multicast IPv6 addresses from local host file.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5615">Bug
          5615</ulink>)
        </para></listitem>

        <listitem><para>
          DHCPv6 dissector formats DUID_LLT time incorrectly.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5627">Bug
          5627</ulink>)
        </para></listitem>

        <listitem><para>
          Allow for IEEE 802.3bc-2009 style PoE TLVs.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5639">Bug
          5639</ulink>)
        </para></listitem>

        <listitem><para>
          Various fixes to the HIP packet dissector.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5646">Bug
          5646</ulink>)
        </para></listitem>

        <listitem><para>
          Display "Day of Year" for January 1 as 1, not 0.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5653">Bug
          5653</ulink>)
        </para></listitem>

        <listitem><para>
          Accommodate the CMake build on Ubuntu 10.10.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5665">Bug
          5665</ulink>)
        </para></listitem>

        <listitem><para>
          E.212 MCC 260 Poland update according to local national regulatory.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5668">Bug
          5668</ulink>)
        </para></listitem>

        <listitem><para>
          IPP on ports other than 631 not recognized.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5677">Bug
          5677</ulink>)
        </para></listitem>

        <listitem><para>
          Potential access violation when writing to LANalyzer files.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5698">Bug
          5698</ulink>)
        </para></listitem>

        <listitem><para>
          IEEE 802.15.4 Superframe Specification - Final CAP Slot always 0.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5700">Bug
          5700</ulink>)
        </para></listitem>

        <listitem><para>
          Peer SRC and DST AS numbers are swapped for cflow.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5702">Bug
          5702</ulink>)
        </para></listitem>

        <listitem><para>
          dumpcap: -q option behavior doesn't match documentation.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5716">Bug
          5716</ulink>)
        </para></listitem>

      </itemizedlist>

    </para>

    </section>

    <section id="NewFeatures"><title>New and Updated Features</title>
    <para>

There are no new features in this release.

    </para>
    </section>

    <section id="NewProtocols"><title>New Protocol Support</title>
    <para>

There are no new protocols in this release.

    </para>
    </section>

    <section id="UpdatedProtocols"><title>Updated Protocol Support</title>
    <para>

<!-- Sort alphabetically -->
ANSI MAP,
BitTorrent,
DCM,
DHCPv6,
DTAP,
DTPT,
E.212,
GSM Management,
GTP,
HIP,
IEEE 802.15.4,
IPP,
LDAP,
LLDP,
Netflow,
NTLMSSP,
P_Mul,
Quake,
Skinny,
SMB,
SNMP,
ULP

    </para>
    </section>

    <section id="NewCapture"><title>New and Updated Capture File Support</title>
    <para>

LANalyzer, Nokia DCT3, Pcap-ng

    </para>
    </section>

  </section>

  <section id="GettingWireshark"><title>Getting Wireshark</title>
    <para>
      Wireshark source code and installation packages are available from
      <ulink url="http://www.wireshark.org/download.html">http://www.wireshark.org/download.html</ulink>.
    </para>

    <section id="VendorPackages"><title>Vendor-supplied Packages</title>
      <para>
        Most Linux and Unix vendors supply their own Wireshark packages.
        You can usually install or upgrade Wireshark using the package management
        system specific to that platform.  A list of third-party packages
        can be found on the
        <ulink url="http://www.wireshark.org/download.html#thirdparty">download page</ulink>
        on the Wireshark web site.
      </para>
    </section>

  </section>

  <!-- XXX needs to be written
  <section id="RemovingWireshark"><title>Removing Wireshark</title>
    <para>
    </para>
  </section>
  -->

  <section id="FileLocations"><title>File Locations</title>
    <para>
      Wireshark and TShark look in several different locations for
      preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
      These locations vary from platform to platform.  You can use
      About->Folders to find the default locations on your system.
    </para>
  </section>

  <section id="KnownProblems"><title>Known Problems</title>

    <para>
      Wireshark might make your system disassociate from a wireless network
      on OS X 10.4.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1315">Bug
      1315</ulink>)
    </para>

    <para>
      Dumpcap might not quit if Wireshark or TShark crashes.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1419">Bug
      1419</ulink>)
    </para>

    <para>
      The BER dissector might infinitely loop.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1516">Bug
      1516</ulink>)
    </para>

    <para>
      Capture filters aren't applied when capturing from named pipes.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1814">Bug
      1814</ulink>)
    </para>

    <para>
      Filtering tshark captures with display filters (-R) no longer works.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234">Bug
      2234</ulink>)
    </para>

    <para>
      The 64-bit Windows installer does not ship with the same libraries as the
      32-bit installer.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3610">Bug
      3610</ulink>)
    </para>

    <para>
      Hex pane display issue after startup.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4056">Bug
      4056</ulink>)
    </para>

    <para>
      Packet list rows are oversized.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4357">Bug
      4357</ulink>)
    </para>

    <para>
      Summary pane selected frame highlighting not maintained.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4445">Bug
      4445</ulink>)
    </para>

  </section>

  <section id="GettingHelp"><title>Getting Help</title>
    <para>
    Community support is available on
    <ulink url="http://ask.wireshark.org/">Wireshark's Q&amp;A site</ulink>
    and on the wireshark-users mailing list.
    Subscription information and archives for all of Wireshark's mailing
    lists can be found on <ulink url="http://www.wireshark.org/lists/">the
    web site</ulink>.
    </para>
    <para>
    Training is available from
    <ulink url="http://www.wiresharktraining.com/">Wireshark University</ulink>.
    </para>
  </section>

  <section id="FAQ"><title>Frequently Asked Questions</title>
    <para>
    A complete FAQ is available on the
    <ulink url="http://www.wireshark.org/faq.html">Wireshark web site</ulink>.
    </para>
  </section>

</article>
