Skip to Content.
Sympa Menu

sm-security - [SM-Security] [SMGLSA-2006:1] ethereal: Multiple security problems

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • To: sm-security <sm-security AT lists.ibiblio.org>
  • Subject: [SM-Security] [SMGLSA-2006:1] ethereal: Multiple security problems
  • Date: Mon, 02 Jan 2006 13:01:20 +0100

Description:

Three security issues have turned up since Ethereal 0.10.13 was released:

* The IRC dissector could go into an infinite loop.
* The GTP dissector could go into an infinite loop.
* iDefense found a buffer overflow in the OSPF dissector.

Impact:

It may be possible to make Ethereal crash, use up available system resources, or run arbitrary code by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed trace file.

Resolution:

Upgrade to 0.10.14.

If you are running a version prior to 0.10.14 and you cannot upgrade, you can disable the GTP, IRC, and OSPF protocol dissectors by selecting Analyze->Enabled Protocols... and disabling them in the list.

For more info: http://www.ethereal.com/appnotes/enpa-sa-00022.html
CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3651


-----
All ethereal users should:
# scribe update
# cast -c ethereal

Personally I am not able to compile ethereal with optional-depends net-snmp (I will working on it). Without net-snmp all works like a charm.


--
Ladislav Hagara



  • [SM-Security] [SMGLSA-2006:1] ethereal: Multiple security problems, Ladislav Hagara, 01/02/2006

Archive powered by MHonArc 2.6.24.

Top of Page