Ethereal 0.9.0 through 0.10.7 allows remote attackers to cause a denial of service (application hang) and possibly fill available disk space via an invalid RTP timestamp.

An Ethreal Security Advisories reports :

Issues have been discovered in the following protocol dissectors :

- Matthew Bing discovered a bug in DICOM dissection that could make Ethereal crash.

- An invalid RTP timestamp could make Ethereal hang and create a large temporary file, possibly filling available disk space.

- The HTTP dissector could access previously-freed memory, causing a crash.

- Brian Caswell discovered that an improperly formatted SMB packet could make Ethereal hang, maximizing CPU utilization.

Impact: It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

Updated Ethereal packages that fix various security vulnerabilities are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ethereal is a program for monitoring network traffic.

A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws.

A flaw in the DICOM dissector could cause a crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1139 to this issue.

A invalid RTP timestamp could hang Ethereal and create a large temporary file, possibly filling available disk space. (CVE-2004-1140)

The HTTP dissector could access previously-freed memory, causing a crash. (CVE-2004-1141)

An improperly formatted SMB packet could make Ethereal hang, maximizing CPU utilization. (CVE-2004-1142)

The COPS dissector could go into an infinite loop. (CVE-2005-0006)

The DLSw dissector could cause an assertion, making Ethereal exit prematurely. (CVE-2005-0007)

The DNP dissector could cause memory corruption. (CVE-2005-0008)

The Gnutella dissector could cause an assertion, making Ethereal exit prematurely. (CVE-2005-0009)

The MMSE dissector could free static memory, causing a crash.
(CVE-2005-0010)

The X11 protocol dissector is vulnerable to a string buffer overflow.
(CVE-2005-0084)

Users of Ethereal should upgrade to these updated packages which contain version 0.10.9 that is not vulnerable to these issues.

Updated Ethereal packages that fix various security vulnerabilities are now available.

Ethereal is a program for monitoring network traffic.

A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws.

A flaw in the DICOM dissector could cause a crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1139 to this issue.

A invalid RTP timestamp could hang Ethereal and create a large temporary file, possibly filling available disk space. (CVE-2004-1140)

The HTTP dissector could access previously-freed memory, causing a crash. (CVE-2004-1141)

An improperly formatted SMB packet could make Ethereal hang, maximizing CPU utilization. (CVE-2004-1142)

The COPS dissector could go into an infinite loop. (CVE-2005-0006)

The DLSw dissector could cause an assertion, making Ethereal exit prematurely. (CVE-2005-0007)

The DNP dissector could cause memory corruption. (CVE-2005-0008)

The Gnutella dissector could cause an assertion, making Ethereal exit prematurely. (CVE-2005-0009)

The MMSE dissector could free static memory, causing a crash.
(CVE-2005-0010)

The X11 protocol dissector is vulnerable to a string buffer overflow.
(CVE-2005-0084)

Users of Ethereal should upgrade to these updated packages which contain version 0.10.9 that is not vulnerable to these issues.

A number of vulnerabilities were discovered in Ethereal :

  - Matthew Bing discovered a bug in DICOM dissection that     could make Ethereal crash (CVE-2004-1139)

  - An invalid RTP timestamp could make Ethereal hang and     create a large temporary file, possibly filling     available disk space (CVE-2004-1140)

  - The HTTP dissector could access previously-freed memory,     causing a crash (CVE-2004-1141)

  - Brian Caswell discovered that an improperly formatted     SMB packet could make Ethereal hang, maximizing CPU     utilization (CVE-2004-1142)

Ethereal 0.10.8 was released to correct these problems and is being provided.

The remote host is affected by the vulnerability described in GLSA-200412-15 (Ethereal: Multiple vulnerabilities)

    There are multiple vulnerabilities in versions of Ethereal earlier     than 0.10.8, including:
    Bug in DICOM dissection     discovered by Bing could make Ethereal crash (CAN 2004-1139).
    An invalid RTP timestamp could make Ethereal hang and create a     large temporary file (CAN 2004-1140).
    The HTTP dissector could     access previously-freed memory (CAN 2004-1141).
    Brian Caswell     discovered that an improperly formatted SMB could make Ethereal hang     (CAN 2004-1142).
  Impact :

    An attacker might be able to use these vulnerabilities to crash     Ethereal, perform DoS by CPU and disk space utilization or even execute     arbitrary code with the permissions of the user running Ethereal, which     could be the root user.
  Workaround :

    For a temporary workaround you can disable all affected protocol     dissectors by selecting Analyze->Enabled Protocols... and deselecting     them from the list. However, it is strongly recommended to upgrade to     the latest stable version.

ID	Name	Product	Family	Severity
19163	FreeBSD : ethereal -- multiple vulnerabilities (efa1344b-5477-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
17171	RHEL 4 : ethereal (RHSA-2005:037)	Nessus	Red Hat Local Security Checks	high
16295	RHEL 2.1 / 3 : ethereal (RHSA-2005:011)	Nessus	Red Hat Local Security Checks	high
16014	Mandrake Linux Security Advisory : ethereal (MDKSA-2004:152)	Nessus	Mandriva Local Security Checks	medium
16002	GLSA-200412-15 : Ethereal: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2004-1140

high

Tenable Plugins

medium

high

high

medium

medium