Multiple buffer overflows in Ethereal 0.8.13 to 0.10.2 allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) NetFlow, (2) IGAP, (3) EIGRP, (4) PGM, (5) IrDA, (6) BGP, (7) ISUP, or (8) TCAP dissectors.

Stefan Esser of e-matters Security discovered a baker's dozen of buffer overflows in Ethereal's decoders, including :

- NetFlow

- IGAP

- EIGRP

- PGM

- IRDA

- BGP

- ISUP

- TCAP

- UCP

In addition, a vulnerability in the RADIUS decoder was found by Jonathan Heusser.

Finally, there is one uncredited vulnerability described by the Ethereal team as :

A zero-length Presentation protocol selector could make Ethereal crash.

CAN-2004-0176 :

Michael Kerrisk noticed an insufficient permission checking in the shmctl() function. Any process was permitted to lock/unlock any System V shared memory segment that fell within the the RLIMIT_MEMLOCK limit (that is the maximum size of shared memory that unprivileged users can acquire). This allowed am unprivileged user process to unlock locked memory of other processes, thereby allowing them to be swapped out.
Usually locked shared memory is used to store passphrases and other sensitive content which must not be written to the swap space (where it could be read out even after a reboot).

CAN-2005-0177 :

OGAWA Hirofumi noticed that the table sizes in nls_ascii.c were incorrectly set to 128 instead of 256. This caused a buffer overflow in some cases which could be exploited to crash the kernel.

CAN-2005-0178 :

A race condition was found in the terminal handling of the 'setsid()' function, which is used to start new process sessions.

http://oss.sgi.com/archives/netdev/2005-01/msg01036.html :

David Coulson noticed a design flaw in the netfilter/iptables module.
By sending specially crafted packets, a remote attacker could exploit this to crash the kernel or to bypass firewall rules.

Fixing this vulnerability required a change in the Application Binary Interface (ABI) of the kernel. This means that third-party user installed modules might not work any more with the new kernel, so this fixed kernel has a new ABI version number. You have to recompile and reinstall all third-party modules.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several buffer overflow vulnerabilities were discovered in ethereal, a network traffic analyzer. These vulnerabilities are described in the ethereal advisory 'enpa-sa-00013'. Of these, only some parts of CAN-2004-0176 affect the version of ethereal in Debian woody.
CAN-2004-0367 and CAN-2004-0365 are not applicable to this version.

The remote host is affected by the vulnerability described in GLSA-200403-07 (Multiple remote overflows and vulnerabilities in Ethereal)

    There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.3, including:
	Thirteen buffer overflows in the following protocol dissectors: NetFlow, IGAP, EIGRP, PGM, IrDA, BGP, ISUP, and TCAP.
      	A zero-length Presentation protocol selector could make Ethereal crash.
     	A vulnerability in the RADIUS packet dissector which may crash ethereal.
      	A corrupt color filter file could cause a segmentation fault.
  Impact :

    These vulnerabilities may cause Ethereal to crash or may allow an attacker     to run arbitrary code on the user's computer.
  Workaround :

    While a workaround is not currently known for this issue, all users are     advised to upgrade to the latest version of the affected package.

A number of serious issues have been discovered in versions of Ethereal prior to 0.10.2. Stefan Esser discovered thirteen buffer overflows in the NetFlow, IGAP, EIGRP, PGM, IrDA, BGP, ISUP, and TCAP dissectors. Jonathan Heusser discovered that a carefully-crafted RADIUS packet could cause Ethereal to crash. It was also found that a zero-length Presentation protocol selector could make Ethereal crash.
Finally, a corrupt color filter file could cause a segmentation fault.
It is possible, through the exploitation of some of these vulnerabilities, to cause Ethereal to crash or run arbitrary code by injecting a malicious, malformed packet onto the wire, by convincing someone to read a malformed packet trace file, or by creating a malformed color filter file.

The updated packages bring Ethereal to version 0.10.3 which is not vulnerable to these issues.

Updated Ethereal packages that fix various security vulnerabilities are now available.

Ethereal is a program for monitoring network traffic.

Stefan Esser reported that Ethereal versions 0.10.1 and earlier contain stack overflows in the IGRP, PGM, Metflow, ISUP, TCAP, or IGAP dissectors. On a system where Ethereal is being run a remote attacker could send malicious packets that could cause Ethereal to crash or execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0176 to this issue.

Jonathan Heussser discovered that a carefully-crafted RADIUS packet could cause a crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0365 to this issue.

Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0367 to this issue.

Users of Ethereal should upgrade to these updated packages, which contain a version of Ethereal that is not vulnerable to these issues.

ID	Name	Product	Family	Severity
38151	FreeBSD : multiple vulnerabilities in ethereal (cdf18ed9-7f4a-11d8-9645-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	medium
20706	Ubuntu 4.10 : linux-source-2.6.8.1 vulnerabilities (USN-82-1)	Nessus	Ubuntu Local Security Checks	high
15348	Debian DSA-511-1 : ethereal - buffer overflows	Nessus	Debian Local Security Checks	medium
14458	GLSA-200403-07 : Multiple remote overflows and vulnerabilities in Ethereal	Nessus	Gentoo Local Security Checks	medium
14123	Mandrake Linux Security Advisory : ethereal (MDKSA-2004:024)	Nessus	Mandriva Local Security Checks	medium
12482	RHEL 2.1 / 3 : ethereal (RHSA-2004:136)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2004-0176

critical

Tenable Plugins

medium

high

medium

medium

medium

medium