[SM-Security] [SMGLSA-2006:1] ethereal: Multiple security problems
Ladislav Hagara
ladislav.hagara at unob.cz
Mon Jan 2 07:01:20 EST 2006
Description:
Three security issues have turned up since Ethereal 0.10.13 was released:
* The IRC dissector could go into an infinite loop.
* The GTP dissector could go into an infinite loop.
* iDefense found a buffer overflow in the OSPF dissector.
Impact:
It may be possible to make Ethereal crash, use up available system
resources, or run arbitrary code by injecting a purposefully malformed
packet onto the wire or by convincing someone to read a malformed trace
file.
Resolution:
Upgrade to 0.10.14.
If you are running a version prior to 0.10.14 and you cannot upgrade,
you can disable the GTP, IRC, and OSPF protocol dissectors by selecting
Analyze->Enabled Protocols... and disabling them in the list.
For more info: http://www.ethereal.com/appnotes/enpa-sa-00022.html
CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3651
-----
All ethereal users should:
# scribe update
# cast -c ethereal
Personally I am not able to compile ethereal with optional-depends
net-snmp (I will working on it). Without net-snmp all works like a charm.
--
Ladislav Hagara
More information about the SM-Security
mailing list