Buffer overflow in the X11 dissector in Ethereal 0.8.10 through 0.10.8 allows remote attackers to execute arbitrary code via a crafted packet.

An Ethreal Security Advisories reports :

Issues have been discovered in the following protocol dissectors :

- The COPS dissector could go into an infinite loop. CVE:
CAN-2005-0006

- The DLSw dissector could cause an assertion. CVE : CAN-2005-0007

- The DNP dissector could cause memory corruption. CVE : CAN-2005-0008

- The Gnutella dissector could cuase an assertion. CVE : CAN-2005-0009

- The MMSE dissector could free statically-allocated memory. CVE:
CAN-2005-0010

- The X11 dissector is vulnerable to a string buffer overflow. CVE:
CAN-2005-0084

Impact: It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

Updated Ethereal packages that fix various security vulnerabilities are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ethereal is a program for monitoring network traffic.

A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws.

A flaw in the DICOM dissector could cause a crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1139 to this issue.

A invalid RTP timestamp could hang Ethereal and create a large temporary file, possibly filling available disk space. (CVE-2004-1140)

The HTTP dissector could access previously-freed memory, causing a crash. (CVE-2004-1141)

An improperly formatted SMB packet could make Ethereal hang, maximizing CPU utilization. (CVE-2004-1142)

The COPS dissector could go into an infinite loop. (CVE-2005-0006)

The DLSw dissector could cause an assertion, making Ethereal exit prematurely. (CVE-2005-0007)

The DNP dissector could cause memory corruption. (CVE-2005-0008)

The Gnutella dissector could cause an assertion, making Ethereal exit prematurely. (CVE-2005-0009)

The MMSE dissector could free static memory, causing a crash.
(CVE-2005-0010)

The X11 protocol dissector is vulnerable to a string buffer overflow.
(CVE-2005-0084)

Users of Ethereal should upgrade to these updated packages which contain version 0.10.9 that is not vulnerable to these issues.

The remote host is affected by the vulnerability described in GLSA-200501-27 (Ethereal: Multiple vulnerabilities)

    There are multiple vulnerabilities in versions of Ethereal earlier     than 0.10.9, including:
    The COPS dissector could go into     an infinite loop (CAN-2005-0006).
    The DLSw dissector could     cause an assertion, making Ethereal exit prematurely     (CAN-2005-0007).
    The DNP dissector could cause memory     corruption (CAN-2005-0008).
    The Gnutella dissector could cause     an assertion, making Ethereal exit prematurely (CAN-2005-0009).
    The MMSE dissector could free statically-allocated memory     (CAN-2005-0010).
    The X11 dissector is vulnerable to a string     buffer overflow (CAN-2005-0084).
  Impact :

    An attacker might be able to use these vulnerabilities to crash     Ethereal, perform DoS by CPU and disk space utilization or even execute     arbitrary code with the permissions of the user running Ethereal, which     could be the root user.
  Workaround :

    For a temporary workaround you can disable all affected protocol     dissectors by selecting Analyze->Enabled Protocols... and deselecting     them from the list. However, it is strongly recommended to upgrade to     the latest stable version.

Updated Ethereal packages that fix various security vulnerabilities are now available.

Ethereal is a program for monitoring network traffic.

A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws.

A flaw in the DICOM dissector could cause a crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1139 to this issue.

A invalid RTP timestamp could hang Ethereal and create a large temporary file, possibly filling available disk space. (CVE-2004-1140)

The HTTP dissector could access previously-freed memory, causing a crash. (CVE-2004-1141)

An improperly formatted SMB packet could make Ethereal hang, maximizing CPU utilization. (CVE-2004-1142)

The COPS dissector could go into an infinite loop. (CVE-2005-0006)

The DLSw dissector could cause an assertion, making Ethereal exit prematurely. (CVE-2005-0007)

The DNP dissector could cause memory corruption. (CVE-2005-0008)

The Gnutella dissector could cause an assertion, making Ethereal exit prematurely. (CVE-2005-0009)

The MMSE dissector could free static memory, causing a crash.
(CVE-2005-0010)

The X11 protocol dissector is vulnerable to a string buffer overflow.
(CVE-2005-0084)

Users of Ethereal should upgrade to these updated packages which contain version 0.10.9 that is not vulnerable to these issues.

A number of vulnerabilities were found in Ethereal, all of which are fixed in version 0.10.9: The COPS dissector could go into an infinite loop (CVE-2005-0006); the DLSw dissector could cause an assertion, making Ethereal exit prematurely (CVE-2005-0007); the DNP dissector could cause memory corruption (CVE-2005-0008); the Gnutella dissector could cause an assertion, making Ethereal exit prematurely (CVE-2005-0009); the MMSE dissector could free static memory (CVE-2005-0010); and the X11 protocol dissector is vulnerable to a string buffer overflow (CVE-2005-0084).

A buffer overflow has been detected in the X11 dissector of ethereal, a commonly used network traffic analyser. A remote attacker may be able to overflow a buffer using a specially crafted IP packet. More problems have been discovered which don't apply to the version in woody but are fixed in sid as well.

ID	Name	Product	Family	Severity
19007	FreeBSD : ethereal -- multiple protocol dissectors vulnerabilities (831a6a66-79fa-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
17171	RHEL 4 : ethereal (RHSA-2005:037)	Nessus	Red Hat Local Security Checks	high
16418	GLSA-200501-27 : Ethereal: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
16295	RHEL 2.1 / 3 : ethereal (RHSA-2005:011)	Nessus	Red Hat Local Security Checks	high
16241	Mandrake Linux Security Advisory : ethereal (MDKSA-2005:013)	Nessus	Mandriva Local Security Checks	high
16237	Debian DSA-653-1 : ethereal - buffer overflow	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2005-0084

critical

Tenable Plugins

high

high

high

high

high

high