Unknown vulnerability in the sFlow dissector in Ethereal 0.9.14 through 0.10.9 allows remote attackers to cause a denial of service (application crash).

Updated Ethereal packages that fix various security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The ethereal package is a program for monitoring network traffic.

A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws and cause Ethereal to crash or potentially execute arbitrary code.

A buffer overflow flaw was discovered in the Etheric dissector. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0704 to this issue.

The GPRS-LLC dissector could crash if the 'ignore cipher bit' option was set. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0705 to this issue.

A buffer overflow flaw was discovered in the 3GPP2 A11 dissector. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0699 to this issue.

A buffer overflow flaw was discovered in the IAPP dissector. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0739 to this issue.

Users of ethereal should upgrade to these updated packages, which contain version 0.10.10 and are not vulnerable to these issues.

A number of issues were discovered in Ethereal versions prior to 0.10.10, which is provided by this update. Matevz Pustisek discovered a buffer overflow in the Etheric dissector (CVE-2005-0704); the GPRS-LLC dissector could crash if the 'ignore cipher bit' was enabled (CVE-2005-0705); Diego Giago found a buffer overflow in the 3GPP2 A11 dissector (CVE-2005-0699); Leon Juranic found a buffer overflow in the IAPP dissector (CVE-2005-0739); and bugs in the JXTA and sFlow dissectors could make Ethereal crash.

The remote host is affected by the vulnerability described in GLSA-200503-16 (Ethereal: Multiple vulnerabilities)

    There are multiple vulnerabilities in versions of Ethereal earlier than     0.10.10, including:
    The Etheric, 3GPP2 A11 and IAPP dissectors are vulnerable to buffer     overflows (CAN-2005-0704, CAN-2005-0699 and CAN-2005-0739).
    The GPRS-LLC could crash when the 'ignore cipher bit' option is     enabled (CAN-2005-0705).
    Various vulnerabilities in JXTA and sFlow dissectors.
  Impact :

    An attacker might be able to use these vulnerabilities to crash     Ethereal and execute arbitrary code with the permissions of the user     running Ethereal, which could be the root user.
  Workaround :

    For a temporary workaround you can disable all affected protocol     dissectors. However, it is strongly recommended that you upgrade to the     latest stable version.

ID	Name	Product	Family	Severity
17366	RHEL 2.1 / 3 / 4 : ethereal (RHSA-2005:306)	Nessus	Red Hat Local Security Checks	high
17331	Mandrake Linux Security Advisory : ethereal (MDKSA-2005:053)	Nessus	Mandriva Local Security Checks	high
17318	GLSA-200503-16 : Ethereal: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-0766

high

Tenable Plugins

high

high

high