Executive Summary

Informations
Name CVE-2003-0356 First vendor Publication 2003-06-09
Vendor Cve Last vendor Modification 2008-09-10

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Security Protection

Impacts Provides administrator access : Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.

Detail

Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIOP Gryphon, (3) OSPF, (4) PPTP, (5) Quake, (6) Quake2, (7) Quake3, (8) Rsync, (9) SMB, (10) SMPP, and (11) TSP dissectors, which do not properly use the tvb_get_nstringz and tvb_get_nstringz0 functions.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0356

CWE : Common Weakness Enumeration

idName
CWE-193Off-by-one Error

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:69
 
Oval ID: oval:org.mitre.oval:def:69
Title: Off-by-one Vulnerabilities in Ethereal 0.9.11
Description: Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIOP Gryphon, (3) OSPF, (4) PPTP, (5) Quake, (6) Quake2, (7) Quake3, (8) Rsync, (9) SMB, (10) SMPP, and (11) TSP dissectors, which do not properly use the tvb_get_nstringz and tvb_get_nstringz0 functions.
Family: unix Class: vulnerability
Reference(s): CVE-2003-0356
Version: 2
Platform(s): Red Hat Linux 9
Product(s): Ethereal
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application1

OpenVAS Exploits

DateDescription
2008-01-17Name : Debian Security Advisory DSA 313-1 (ethereal)
File : nvt/deb_313_1.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
6917Ethereal TSP Dissector Remote Off-by-one Overflow
6916Ethereal SMPP Dissector Remote Off-by-one Overflow
6915Ethereal SMB Dissector Remote Off-by-one Overflow
6914Ethereal rsync Dissector Remote Off-by-one Overflow
6913Ethereal Quake3 Dissector Remote Off-by-one Overflow
6912Ethereal Quake2 Dissector Remote Off-by-one Overflow
6911Ethereal Quake Dissector Remote Off-by-one Overflow
6910Ethereal PPTP Dissector Remote Off-by-one Overflow
6909Ethereal OSPF Dissector Remote Off-by-one Overflow
6908Ethereal GIOP Gryphon Dissector Remote Off-by-one Overflow
4341Ethereal AIM Dissector Remote Off-by-one Overflow

Nessus® Vulnerability Scanner

DateDescription
2004-09-29Name : The remote Debian host is missing a security-related update.
File : debian_DSA-313.nasl - Type : ACT_GATHER_INFO
2004-07-31Name : The remote Mandrake Linux host is missing a security update.
File : mandrake_MDKSA-2003-067.nasl - Type : ACT_GATHER_INFO
2004-07-06Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2003-077.nasl - Type : ACT_GATHER_INFO

Internal Sources (Detail)

SourceUrl
CERT-VN http://www.kb.cert.org/vuls/id/641013
CONFIRM http://www.ethereal.com/appnotes/enpa-sa-00009.html
DEBIAN http://www.debian.org/security/2003/dsa-313
MANDRAKE http://www.mandriva.com/security/advisories?name=MDKSA-2003:067
REDHAT http://www.redhat.com/support/errata/RHSA-2003-077.html

Alert History

If you want to see full details history, please login or register.
0
1
DateInformations
2014-02-17 10:26:09
  • Multiple Updates
2013-05-11 11:51:14
  • Multiple Updates