• This forum has a zero tolerance policy regarding spam. If you register here to publish advertising, your user account will be deleted without further questions.

Updated Ethereal packages fix security issues

Thorsten

SSF Facilitymanagement
Staff member
Updated Ethereal packages that fix two security vulnerabilities are now
available.
Description
Ethereal is a program for monitoring network traffic.

Two security issues have been found that affect Ethereal. By exploiting
these issues it may be possible to make Ethereal crash by injecting an
intentionally malformed packet onto the wire or by convincing someone to
read a malformed packet trace file. It is not known if these issues could
allow arbitrary code execution.

The SMB dissector in Ethereal before 0.10.0 allows remote attackers to
cause a denial of service via a malformed SMB packet that triggers a
segmentation fault during processing of Selected packets. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2003-1012 to this issue.

The Q.931 dissector in Ethereal before 0.10.0 allows remote attackers to
cause a denial of service (crash) via a malformed Q.931, which triggers a
null dereference. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2003-1013 to this issue.

Users of Ethereal should update to these erratum packages containing
Ethereal version 0.10.0, which is not vulnerable to these issues.
Affected Channels
Red Hat Linux 9 i386

Fixes
(none)
Keywords
(none)
CVEs
CAN-2003-1012
CAN-2003-1013
References
http://www.ethereal.com/appnotes/enpa-sa-00012.html
Notes
(none)
 
Back
Top