Detections
Analytics

Debian DSA-313-1 : ethereal - buffer overflows, integer overflows

critical Nessus Plugin ID 15150

Synopsis

The remote Debian host is missing a security-related update.

Description

Timo Sirainen discovered several vulnerabilities in ethereal, a network traffic analyzer. These include one-byte buffer overflows in the AIM, GIOP Gryphon, OSPF, PPTP, Quake, Quake2, Quake3, Rsync, SMB, SMPP, and TSP dissectors, and integer overflows in the Mount and PPP dissectors.

Solution

For the stable distribution (woody) these problems have been fixed in version 0.9.4-1woody4.

The old stable distribution (potato) does not appear to contain these vulnerabilities.

We recommend that you update your ethereal package.

See Also

http://www.debian.org/security/2003/dsa-313

Plugin Details

Severity: Critical

ID: 15150

File Name: debian_DSA-313.nasl

Version: 1.23

Type: local

Agent: unix

Published: 9/29/2004

Updated: 1/4/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:3.0, p-cpe:/a:debian:debian_linux:ethereal

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 6/11/2003

Vulnerability Publication Date: 5/1/2003

Reference Information

CVE: CVE-2003-0356, CVE-2003-0357

BID: 7493, 7494, 7495

DSA: 313