Stack-based buffer overflow in the dissect_ospf_v3_address_prefix function in the OSPF protocol dissector in Ethereal 0.10.12, and possibly other versions, allows remote attackers to execute arbitrary code via crafted packets.

A buffer overflow has been discovered in ethereal, a commonly used network traffic analyser that causes a denial of service and may potentially allow the execution of arbitrary code.

Updated Ethereal packages that fix various security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ethereal is a program for monitoring network traffic.

Two denial of service bugs were found in Ethereal's IRC and GTP protocol dissectors. Ethereal could crash or stop responding if it reads a malformed IRC or GTP packet off the network. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the names CVE-2005-3313 and CVE-2005-4585 to these issues.

A buffer overflow bug was found in Ethereal's OSPF protocol dissector.
Ethereal could crash or execute arbitrary code if it reads a malformed OSPF packet off the network. (CVE-2005-3651)

Users of ethereal should upgrade to these updated packages containing version 0.10.14, which is not vulnerable to these issues.

Three vulnerabilities were discovered in Ethereal 0.10.13 :

The IRC and GTP dissectors could go into an infinite loop.

A buffer overflow was discovered by iDefense in the OSPF dissector.

Ethereal has been upgraded to 0.10.14 which does not suffer from these problems.

A stack-based buffer overflow was discovered in the OSPF dissector in Ethereal. This could potentially be abused to allow remote attackers to execute arbitrary code via crafted packets.

The updated packages have been patched to prevent this problem.

The remote host is affected by the vulnerability described in GLSA-200512-06 (Ethereal: Buffer overflow in OSPF protocol dissector)

    iDEFENSE reported a possible overflow due to the lack of bounds     checking in the dissect_ospf_v3_address_prefix() function, part of the     OSPF protocol dissector.
  Impact :

    An attacker might be able to craft a malicious network flow that     would crash Ethereal. It may be possible, though unlikely, to exploit     this flaw to execute arbitrary code with the permissions of the user     running Ethereal, which could be the root user.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
22786	Debian DSA-920-1 : ethereal - buffer overflow	Nessus	Debian Local Security Checks	high
21883	CentOS 3 / 4 : ethereal (CESA-2006:0156)	Nessus	CentOS Local Security Checks	high
20480	RHEL 2.1 / 3 / 4 : ethereal (RHSA-2006:0156)	Nessus	Red Hat Local Security Checks	high
20472	Mandrake Linux Security Advisory : ethereal (MDKSA-2006:002)	Nessus	Mandriva Local Security Checks	high
20458	Mandrake Linux Security Advisory : ethereal (MDKSA-2005:227)	Nessus	Mandriva Local Security Checks	high
20315	GLSA-200512-06 : Ethereal: Buffer overflow in OSPF protocol dissector	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-3651

critical

Tenable Plugins

high

high

high

high

high

high