Ethereal 0.9.15 and earlier, and Tethereal, allows remote attackers to cause a denial of service (crash) via certain malformed (1) ISAKMP or (2) MEGACO packets.

Several vulnerabilities were discovered upstream in ethereal, a network traffic analyzer. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2003-0925     A buffer overflow allows remote attackers to cause a     denial of service and possibly execute arbitrary code     via a malformed GTP MSISDN string.

  - CAN-2003-0926

    Via certain malformed ISAKMP or MEGACO packets remote     attackers are able to cause a denial of service (crash).

  - CAN-2003-0927

    A heap-based buffer overflow allows remote attackers to     cause a denial of service (crash) and possibly execute     arbitrary code via the SOCKS dissector.

  - CAN-2003-1012

    The SMB dissector allows remote attackers to cause a     denial of service via a malformed SMB packet that     triggers a segmentation fault during processing of     selected packets.

  - CAN-2003-1013

    The Q.931 dissector allows remote attackers to cause a     denial of service (crash) via a malformed Q.931, which     triggers a null dereference.

A number of vulnerabilities were discovered in ethereal that, if exploited, could be used to make ethereal crash or run arbitrary code by injecting malicious malformed packets onto the wire or by convincing someone to read a malformed packet trace file.

A buffer overflow allows attackers to cause a DoS (Denial of Service) and possibly execute arbitrary code using a malformed GTP MSISDN string (CVE-2003-0925).

Likewise, a DoS can be caused by using malformed ISAKMP or MEGACO packets (CVE-2003-0926).

Finally, a heap-based buffer overflow allows attackers to cause a DoS or execute arbitrary code using the SOCKS dissector (CVE-2003-0927).

All three vulnerabilities affect all versions of Ethereal up to and including 0.9.15. This update provides 0.9.16 which corrects all of these issues. Also note that each vulnerability can be exploited by a remote attacker.

Updated Ethereal packages that fix a number of exploitable security issues are now available.

Ethereal is a program for monitoring network traffic.

A number of security issues affect Ethereal. By exploiting these issues, it may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully-malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

A buffer overflow in Ethereal 0.9.15 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed GTP MSISDN string. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0925 to this issue.

Ethereal 0.9.15 and earlier allows remote attackers to cause a denial of service (crash) via certain malformed ISAKMP or MEGACO packets. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0926 to this issue.

A heap-based buffer overflow in Ethereal 0.9.15 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the SOCKS dissector. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0927 to this issue.

Users of Ethereal should update to these erratum packages containing Ethereal version 0.9.16, which is not vulnerable to these issues.

ID	Name	Product	Family	Severity
15244	Debian DSA-407-1 : ethereal - buffer overflows	Nessus	Debian Local Security Checks	high
14096	Mandrake Linux Security Advisory : ethereal (MDKSA-2003:114)	Nessus	Mandriva Local Security Checks	high
12433	RHEL 2.1 / 3 : ethereal (RHSA-2003:324)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2003-0926

high

Tenable Plugins

high

high

high