The IAPP dissector (packet-iapp.c) for Ethereal 0.9.1 to 0.10.9 does not properly use certain routines for formatting strings, which could leave it vulnerable to buffer overflows, as demonstrated using modified length values that are not properly handled by the dissect_pdus and pduval_to_str functions.

An Ethreal Security Advisories reports :

Issues have been discovered in the following protocol dissectors :

- Matevz Pustisek discovered a buffer overflow in the Etheric dissector. CVE: CAN-2005-0704

- The GPRS-LLC dissector could crash if the 'ignore cipher bit' option was enabled. CVE: CAN-2005-0705

- Diego Giago discovered a buffer overflow in the 3GPP2 A11 dissector.
This flaw was later reported by Leon Juranic. CVE: CAN-2005-0699

- Leon Juranic discovered a buffer overflow in the IAPP dissector.
CVE: CAN-2005-0739

- A bug in the JXTA dissector could make Ethereal crash.

- A bug in the sFlow dissector could make Ethereal crash.

[ This version lists the correct packages in the packages section. ]

A buffer overflow has been detected in the IAPP dissector of Ethereal, a commonly used network traffic analyser. A remote attacker may be able to overflow a buffer using a specially crafted packet. More problems have been discovered which don't apply to the version in woody but are fixed in sid as well.

Updated Ethereal packages that fix various security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The ethereal package is a program for monitoring network traffic.

A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws and cause Ethereal to crash or potentially execute arbitrary code.

A buffer overflow flaw was discovered in the Etheric dissector. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0704 to this issue.

The GPRS-LLC dissector could crash if the 'ignore cipher bit' option was set. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0705 to this issue.

A buffer overflow flaw was discovered in the 3GPP2 A11 dissector. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0699 to this issue.

A buffer overflow flaw was discovered in the IAPP dissector. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0739 to this issue.

Users of ethereal should upgrade to these updated packages, which contain version 0.10.10 and are not vulnerable to these issues.

A number of issues were discovered in Ethereal versions prior to 0.10.10, which is provided by this update. Matevz Pustisek discovered a buffer overflow in the Etheric dissector (CVE-2005-0704); the GPRS-LLC dissector could crash if the 'ignore cipher bit' was enabled (CVE-2005-0705); Diego Giago found a buffer overflow in the 3GPP2 A11 dissector (CVE-2005-0699); Leon Juranic found a buffer overflow in the IAPP dissector (CVE-2005-0739); and bugs in the JXTA and sFlow dissectors could make Ethereal crash.

The remote host is affected by the vulnerability described in GLSA-200503-16 (Ethereal: Multiple vulnerabilities)

    There are multiple vulnerabilities in versions of Ethereal earlier than     0.10.10, including:
    The Etheric, 3GPP2 A11 and IAPP dissectors are vulnerable to buffer     overflows (CAN-2005-0704, CAN-2005-0699 and CAN-2005-0739).
    The GPRS-LLC could crash when the 'ignore cipher bit' option is     enabled (CAN-2005-0705).
    Various vulnerabilities in JXTA and sFlow dissectors.
  Impact :

    An attacker might be able to use these vulnerabilities to crash     Ethereal and execute arbitrary code with the permissions of the user     running Ethereal, which could be the root user.
  Workaround :

    For a temporary workaround you can disable all affected protocol     dissectors. However, it is strongly recommended that you upgrade to the     latest stable version.

ID	Name	Product	Family	Severity
19120	FreeBSD : ethereal -- multiple protocol dissectors vulnerabilities (cb470368-94d2-11d9-a9e0-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
18157	Debian DSA-718-2 : ethereal - buffer overflow	Nessus	Debian Local Security Checks	medium
17366	RHEL 2.1 / 3 / 4 : ethereal (RHSA-2005:306)	Nessus	Red Hat Local Security Checks	high
17331	Mandrake Linux Security Advisory : ethereal (MDKSA-2005:053)	Nessus	Mandriva Local Security Checks	high
17318	GLSA-200503-16 : Ethereal: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-0739

critical

Tenable Plugins

high

medium

high

high

high