Executive Summary

Informations
NameCVE-2003-0356First vendor Publication2003-06-09
VendorCveLast vendor Modification2008-09-10

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score10Attack RangeNetwork
Cvss Impact Score10Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Security Protection

ImpactsProvides administrator access : Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.

Detail

Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIOP Gryphon, (3) OSPF, (4) PPTP, (5) Quake, (6) Quake2, (7) Quake3, (8) Rsync, (9) SMB, (10) SMPP, and (11) TSP dissectors, which do not properly use the tvb_get_nstringz and tvb_get_nstringz0 functions.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0356

CWE : Common Weakness Enumeration

idName
CWE-193Off-by-one Error

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:69
 
Oval ID: oval:org.mitre.oval:def:69
Title: Off-by-one Vulnerabilities in Ethereal 0.9.11
Description: Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIOP Gryphon, (3) OSPF, (4) PPTP, (5) Quake, (6) Quake2, (7) Quake3, (8) Rsync, (9) SMB, (10) SMPP, and (11) TSP dissectors, which do not properly use the tvb_get_nstringz and tvb_get_nstringz0 functions.
Family: unix Class: vulnerability
Reference(s): CVE-2003-0356
Version: 2
Platform(s): Red Hat Linux 9
Product(s): Ethereal
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application1

OpenVAS Exploits

DateDescription
2008-01-17Name : Debian Security Advisory DSA 313-1 (ethereal)
File : nvt/deb_313_1.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
6917Ethereal TSP Dissector Remote Off-by-one Overflow
6916Ethereal SMPP Dissector Remote Off-by-one Overflow
6915Ethereal SMB Dissector Remote Off-by-one Overflow
6914Ethereal rsync Dissector Remote Off-by-one Overflow
6913Ethereal Quake3 Dissector Remote Off-by-one Overflow
6912Ethereal Quake2 Dissector Remote Off-by-one Overflow
6911Ethereal Quake Dissector Remote Off-by-one Overflow
6910Ethereal PPTP Dissector Remote Off-by-one Overflow
6909Ethereal OSPF Dissector Remote Off-by-one Overflow
6908Ethereal GIOP Gryphon Dissector Remote Off-by-one Overflow
4341Ethereal AIM Dissector Remote Off-by-one Overflow

Nessus® Vulnerability Scanner

DateDescription
2004-09-29Name : The remote Debian host is missing a security-related update.
File : debian_DSA-313.nasl - Type : ACT_GATHER_INFO
2004-07-31Name : The remote Mandrake Linux host is missing a security update.
File : mandrake_MDKSA-2003-067.nasl - Type : ACT_GATHER_INFO
2004-07-06Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2003-077.nasl - Type : ACT_GATHER_INFO

Internal Sources (Detail)

SourceUrl
CERT-VNhttp://www.kb.cert.org/vuls/id/641013
CONFIRMhttp://www.ethereal.com/appnotes/enpa-sa-00009.html
DEBIANhttp://www.debian.org/security/2003/dsa-313
MANDRAKEhttp://www.mandriva.com/security/advisories?name=MDKSA-2003:067
REDHAThttp://www.redhat.com/support/errata/RHSA-2003-077.html

Alert History

If you want to see full details history, please login or register.
0
1
DateInformations
2014-02-17 10:26:09
  • Multiple Updates
2013-05-11 11:51:14
  • Multiple Updates