The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference.

Stefan Esser of e-matters Security discovered a baker's dozen of buffer overflows in Ethereal's decoders, including :

- NetFlow

- IGAP

- EIGRP

- PGM

- IRDA

- BGP

- ISUP

- TCAP

- UCP

In addition, a vulnerability in the RADIUS decoder was found by Jonathan Heusser.

Finally, there is one uncredited vulnerability described by the Ethereal team as :

A zero-length Presentation protocol selector could make Ethereal crash.

The remote host is affected by the vulnerability described in GLSA-200403-07 (Multiple remote overflows and vulnerabilities in Ethereal)

    There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.3, including:
	Thirteen buffer overflows in the following protocol dissectors: NetFlow, IGAP, EIGRP, PGM, IrDA, BGP, ISUP, and TCAP.
      	A zero-length Presentation protocol selector could make Ethereal crash.
     	A vulnerability in the RADIUS packet dissector which may crash ethereal.
      	A corrupt color filter file could cause a segmentation fault.
  Impact :

    These vulnerabilities may cause Ethereal to crash or may allow an attacker     to run arbitrary code on the user's computer.
  Workaround :

    While a workaround is not currently known for this issue, all users are     advised to upgrade to the latest version of the affected package.

A number of serious issues have been discovered in versions of Ethereal prior to 0.10.2. Stefan Esser discovered thirteen buffer overflows in the NetFlow, IGAP, EIGRP, PGM, IrDA, BGP, ISUP, and TCAP dissectors. Jonathan Heusser discovered that a carefully-crafted RADIUS packet could cause Ethereal to crash. It was also found that a zero-length Presentation protocol selector could make Ethereal crash.
Finally, a corrupt color filter file could cause a segmentation fault.
It is possible, through the exploitation of some of these vulnerabilities, to cause Ethereal to crash or run arbitrary code by injecting a malicious, malformed packet onto the wire, by convincing someone to read a malformed packet trace file, or by creating a malformed color filter file.

The updated packages bring Ethereal to version 0.10.3 which is not vulnerable to these issues.

Updated Ethereal packages that fix various security vulnerabilities are now available.

Ethereal is a program for monitoring network traffic.

Stefan Esser reported that Ethereal versions 0.10.1 and earlier contain stack overflows in the IGRP, PGM, Metflow, ISUP, TCAP, or IGAP dissectors. On a system where Ethereal is being run a remote attacker could send malicious packets that could cause Ethereal to crash or execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0176 to this issue.

Jonathan Heussser discovered that a carefully-crafted RADIUS packet could cause a crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0365 to this issue.

Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0367 to this issue.

Users of Ethereal should upgrade to these updated packages, which contain a version of Ethereal that is not vulnerable to these issues.

ID	Name	Product	Family	Severity
38151	FreeBSD : multiple vulnerabilities in ethereal (cdf18ed9-7f4a-11d8-9645-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	medium
14458	GLSA-200403-07 : Multiple remote overflows and vulnerabilities in Ethereal	Nessus	Gentoo Local Security Checks	medium
14123	Mandrake Linux Security Advisory : ethereal (MDKSA-2004:024)	Nessus	Mandriva Local Security Checks	medium
12482	RHEL 2.1 / 3 : ethereal (RHSA-2004:136)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2004-0365

high

Tenable Plugins

medium

medium

medium

medium