The SMB SID snooping capability in Ethereal 0.9.15 to 0.10.4 allows remote attackers to cause a denial of service (process crash) via a handle without a policy name, which causes a null dereference.

Issues have been discovered in multiple protocol dissectors.

The remote host is affected by the vulnerability described in GLSA-200407-08 (Ethereal: Multiple security problems)

    There are multiple vulnerabilities in versions of Ethereal earlier than     0.10.5, including:
    In some cases the iSNS dissector could cause Ethereal to     abort.
    If there was no policy name for a handle for SMB SID snooping it     could cause a crash.
    A malformed or missing community string could cause the SNMP     dissector to crash.
  Impact :

    An attacker could use these vulnerabilities to crash Ethereal or even     execute arbitrary code with the permissions of the user running     Ethereal, which could be the root user.
  Workaround :

    For a temporary workaround you can disable all affected protocol     dissectors by selecting Analyze->Enabled Protocols... and deselecting     them from the list. For SMB you can disable SID snooping in the SMB     protocol preference. However, it is strongly recommended to upgrade to     the latest stable version.

Updated Ethereal packages that fix various security vulnerabilities are now available.

Ethereal is a program for monitoring network traffic.

The SNMP dissector in Ethereal releases 0.8.15 through 0.10.4 contained a memory read flaw. On a system where Ethereal is running, a remote attacker could send malicious packets that could cause Ethereal to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0635 to this issue.

The SMB dissector in Ethereal releases 0.9.15 through 0.10.4 contained a NULL pointer flaw. On a system where Ethereal is running, a remote attacker could send malicious packets that could cause Ethereal to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0634 to this issue.

The iSNS dissector in Ethereal releases 0.10.3 through 0.10.4 contained an integer overflow flaw. On a system where Ethereal is running, a remote attacker could send malicious packets that could cause Ethereal to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0633 to this issue.

Users of Ethereal should upgrade to these updated packages, which contain a version that is not vulnerable to these issues.

Three vulnerabilities were discovered in Ethereal versions prior to 0.10.5 in the iSNS, SMB SID, and SNMP dissectors. It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet into the wire or by convincing someone to read a malformed packet trace file.

These vulnerabilities have been corrected in Ethereal 0.10.5.

Issues have been discovered in the following protocol dissectors :

  - The iSNS dissector could make Ethereal abort in some     cases. (0.10.3 - 0.10.4) CVE-2004-0633

  - SMB SID snooping could crash if there was no policy name     for a handle. (0.9.15 - 0.10.4) CVE-2004-0634

  - The SNMP dissector could crash due to a malformed or     missing community string. (0.8.15 - 0.10.4)     CVE-2004-0635

Impact :

It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

Resolution :

Upgrade to 0.10.5.

If you are running a version prior to 0.10.5 and you cannot upgrade, you can disable all of the protocol dissectors listed above by selecting Analyze->Enabled Protocols... and deselecting them from the list. For SMB, you can alternatively disable SID snooping in the SMB protocol preferences. However, it is strongly recommended that you upgrade to 0.10.5.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
36365	FreeBSD : multiple vulnerabilities in ethereal (265c8b00-d2d0-11d8-b479-02e0185c0b53)	Nessus	FreeBSD Local Security Checks	medium
14541	GLSA-200407-08 : Ethereal: Multiple security problems	Nessus	Gentoo Local Security Checks	medium
14215	RHEL 2.1 / 3 : ethereal (RHSA-2004:378)	Nessus	Red Hat Local Security Checks	medium
14166	Mandrake Linux Security Advisory : ethereal (MDKSA-2004:067)	Nessus	Mandriva Local Security Checks	medium
13739	Fedora Core 2 : ethereal-0.10.5-0.2.1 (2004-220)	Nessus	Fedora Local Security Checks	medium
13738	Fedora Core 1 : ethereal-0.10.5-0.1.1 (2004-219)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2004-0634

high

Tenable Plugins

medium

medium

medium

medium

medium

medium