Executive Summary
Summary | |
---|---|
Title | New ethereal packages fix several vulnerabilities |
Informations | |||
---|---|---|---|
Name | DSA-853 | First vendor Publication | 2005-10-09 |
Vendor | Debian | Last vendor Modification | 2005-10-09 |
Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Several security problems have been discovered in ethereal, a commonly used network traffic analyser. The Common Vulnerabilities and Exposures project identifies the following problems: CAN-2005-2360 Memory allocation errors in the LDAP dissector can cause a denial of service. CAN-2005-2361 Various errors in the AgentX, PER, DOCSIS, RADIUS, Telnet, IS-IS, HTTP, DCERPC, DHCP and SCTP dissectors can cause a denial of service. CAN-2005-2363 Various errors in the SMPP, 802.3, H1 and DHCP dissectors can cause a denial of service. CAN-2005-2364 Null pointer dereferences in the WBXML and GIOP dissectors can cause a denial of service. CAN-2005-2365 A buffer overflow and null pointer dereferences in the SMB dissector can cause a denial of service. CAN-2005-2366 Wrong address calculation in the BER dissector can cause an infinite loop or abortion. CAN-2005-2367 Format string vulnerabilities in the several dissectors allow remote attackers to write to arbitrary memory locations and thus gain privileges. For the old stable distribution (woody) these problems have been fixed in version 0.9.4-1woody13. For the stable distribution (sarge) these problems have been fixed in version 0.10.10-2sarge3. For the unstable distribution (sid) these problems have been fixed in version 0.10.12-2. We recommend that you upgrade your ethereal packages. |
Original Source
Url : http://www.debian.org/security/2005/dsa-853 |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:10007 | |||
Oval ID: | oval:org.mitre.oval:def:10007 | ||
Title: | Unknown vulnerability in the (1) GIOP dissector, (2) WBXML, or (3) CAMEL dissector in Ethereal 0.8.20 through 0.10.11 allows remote attackers to cause a denial of service (application crash) via certain packets that cause a null pointer dereference. | ||
Description: | Unknown vulnerability in the (1) GIOP dissector, (2) WBXML, or (3) CAMEL dissector in Ethereal 0.8.20 through 0.10.11 allows remote attackers to cause a denial of service (application crash) via certain packets that cause a null pointer dereference. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2005-2364 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:10225 | |||
Oval ID: | oval:org.mitre.oval:def:10225 | ||
Title: | Unknown vulnerability in the (1) AgentX dissector, (2) PER dissector, (3) DOCSIS dissector, (4) SCTP graphs, (5) HTTP dissector, (6) DCERPC, (7) DHCP, (8) RADIUS dissector, (9) Telnet dissector, (10) IS-IS LSP dissector, or (11) NCP dissector in Ethereal 0.8.19 through 0.10.11 allows remote attackers to cause a denial of service (application crash or abort) via unknown attack vectors. | ||
Description: | Unknown vulnerability in the (1) AgentX dissector, (2) PER dissector, (3) DOCSIS dissector, (4) SCTP graphs, (5) HTTP dissector, (6) DCERPC, (7) DHCP, (8) RADIUS dissector, (9) Telnet dissector, (10) IS-IS LSP dissector, or (11) NCP dissector in Ethereal 0.8.19 through 0.10.11 allows remote attackers to cause a denial of service (application crash or abort) via unknown attack vectors. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2005-2361 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:10765 | |||
Oval ID: | oval:org.mitre.oval:def:10765 | ||
Title: | Format string vulnerability in the proto_item_set_text function in Ethereal 0.9.4 through 0.10.11, as used in multiple dissectors, allows remote attackers to write to arbitrary memory locations and gain privileges via a crafted AFP packet. | ||
Description: | Format string vulnerability in the proto_item_set_text function in Ethereal 0.9.4 through 0.10.11, as used in multiple dissectors, allows remote attackers to write to arbitrary memory locations and gain privileges via a crafted AFP packet. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2005-2367 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:11239 | |||
Oval ID: | oval:org.mitre.oval:def:11239 | ||
Title: | Unknown vulnerability in the BER dissector in Ethereal 0.10.11 allows remote attackers to cause a denial of service (abort or infinite loop) via unknown attack vectors. | ||
Description: | Unknown vulnerability in the BER dissector in Ethereal 0.10.11 allows remote attackers to cause a denial of service (abort or infinite loop) via unknown attack vectors. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2005-2366 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:11254 | |||
Oval ID: | oval:org.mitre.oval:def:11254 | ||
Title: | Unknown vulnerability in the LDAP dissector in Ethereal 0.8.5 through 0.10.11 allows remote attackers to cause a denial of service (free static memory and application crash) via unknown attack vectors. | ||
Description: | Unknown vulnerability in the LDAP dissector in Ethereal 0.8.5 through 0.10.11 allows remote attackers to cause a denial of service (free static memory and application crash) via unknown attack vectors. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2005-2360 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:11271 | |||
Oval ID: | oval:org.mitre.oval:def:11271 | ||
Title: | Unknown vulnerability in the (1) SMPP dissector, (2) 802.3 dissector, (3) DHCP, (4) MEGACO dissector, or (5) H1 dissector in Ethereal 0.8.15 through 0.10.11 allows remote attackers to cause a denial of service (infinite loop) via unknown attack vectors. | ||
Description: | Unknown vulnerability in the (1) SMPP dissector, (2) 802.3 dissector, (3) DHCP, (4) MEGACO dissector, or (5) H1 dissector in Ethereal 0.8.15 through 0.10.11 allows remote attackers to cause a denial of service (infinite loop) via unknown attack vectors. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2005-2363 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:9118 | |||
Oval ID: | oval:org.mitre.oval:def:9118 | ||
Title: | Unknown vulnerability in the SMB dissector in Ethereal 0.9.0 through 0.10.11 allows remote attackers to cause a buffer overflow or a denial of service (memory consumption) via unknown attack vectors. | ||
Description: | Unknown vulnerability in the SMB dissector in Ethereal 0.9.0 through 0.10.11 allows remote attackers to cause a buffer overflow or a denial of service (memory consumption) via unknown attack vectors. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2005-2365 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2009-10-10 | Name : SLES9: Security update for ethereal File : nvt/sles9p5015871.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200507-27 (Ethereal) File : nvt/glsa_200507_27.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 853-1 (ethereal) File : nvt/deb_853_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
18670 | Ethereal AFP Protocol Dissector Remote Format String Ethereal contains a format string flaw that may allow a malicious user to execute arbitrary code. The issue is triggered when unchecked data is passed to proto_item_set_text() which uses formats. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity. |
18388 | Ethereal Multiple Unspecified Dissector Format String Overflow Ethereal contains an unspecified format string flaw related to several dissectors that may allow an attacker to execute arbitrary code. No further details have been provided. |
18385 | Ethereal DHCP Dissector Unspecified DoS Ethereal contains an unspecified flaw related to the DHCP dissector that may allow an attacker to cause a denial of service. No further details have been provided. |
18384 | Ethereal CAMEL Dissector Unspecified DoS Ethereal contains an unspecified flaw related to the CAMEL that may allow an attacker to cause a denial of service. No further details have been provided. |
18383 | Ethereal HTTP Dissector Unspecified DoS Ethereal contains an unspecified flaw related to the HTTP dissector that may allow an attacker to cause a denial of service. No further details have been provided. |
18381 | Ethereal DCERPC Dissector Unspecified DoS Ethereal contains an unspecified flaw related to the DCERPC dissector that may allow an attacker to cause a denial of service. No further details have been provided. |
18380 | Ethereal DOCSIS Dissector Unspecified DoS Ethereal contains a flaw that may allow a remote denial of service. The issue is triggered when the DOCSIS Dissector processes an unspecified malformed packet, and will result in loss of availability for the service. |
18379 | Ethereal SMPP Dissector Infinite Loop DoS |
18378 | Ethereal SCTP Graphs Unspecified DoS Ethereal contains an unspecified flaw related to the SCTP graphs that may allow an attacker to cause a denial of service. No further details have been provided. |
18377 | Ethereal GIOP Dissector Null Pointer Dereference DoS Ethereal contains a flaw related to the GIOP dissector that may allow an attacker to cause a denial of service by dereferencing a null pointer. No further details have been provided. |
18376 | Ethereal SMB Dissector Unspecified Remote Overflow Ethereal contains an unspecified buffer overflow related to the SMB dissector. No further details have been provided. |
18375 | Ethereal WBXML Dissector Null Pointer Dereference DoS |
18374 | Ethereal H1 Dissector Infinite Loop DoS Ethereal contains an unspecified flaw related to the H1 dissector that may allow an attacker to cause a denial of service by triggering an infinite loop. No further details have been provided. |
18373 | Ethereal BER Dissector Multiple Method DoS Ethereal contains a flaw related to the BER dissector that may allow an attacker to cause a denial of service via an abort or infinite loop. No further details have been provided. |
18372 | Ethereal MEGACO Dissector Infinite Loop DoS Ethereal contains an unspecified flaw related to the MEGACO dissector that may allow an attacker to cause a denial of service via an infinite loop. No further details have been provided. |
18371 | Ethereal PER Dissector Unspecified DoS Ethereal contains an unspecified flaw related to the PER dissector that may allow an attacker to cause a denial of service. No further details have been provided. |
18370 | Ethereal RADIUS Dissector Unspecified DoS Ethereal contains an unspecified flaw related to the RADIUS dissector that may allow an attacker to cause a denial of service. No further details have been provided. |
18369 | Ethereal Telnet Dissector Unspecified DoS Ethereal contains an unspecified flaw related to the Telnet dissector that may allow an attacker to cause a denial of service. No further details have been provided. |
18368 | Ethereal IS-IS LSP Dissector Unspecified DoS Ethereal contains an unspecified flaw related to the IS-IS LSP dissector that may allow an attacker to cause a denial of service. No further details have been provided. |
18367 | Ethereal NCP Dissector Unspecified DoS Ethereal contains an unspecified flaw related to the NCP dissector that may allow an attacker to cause a denial of service. No further details have been provided. |
18366 | Ethereal DHCP Dissector Infinite Loop DoS Ethereal contains an unspecified flaw related to the DHCP dissector that may allow an attacker to cause a denial of service by sending the program into an infinite loop. No further details have been provided. |
18365 | Ethereal PER Dissector Unspecified DoS Ethereal contains an unspecified flaw related to the PER dissector that may allow an attacker to cause a denial of service. No further details have been provided. |
18364 | Ethereal 802.3 Dissector Infinite Loop DoS Ethereal contains an unspecified flaw that may allow a remote denial of service. The issue is related to the 802.3 dissector, which could go into an infinite loop and result in loss of availability for the application. |
18363 | Ethereal AgentX Dissector Unspecified DoS Ethereal contains an unspecified flaw related to the AgentX dissector that may allow an attacker to crash the program. No further details have been provided. |
18362 | Ethereal LDAP Dissector Unspecified Memory Free DoS Ethereal contains an unspecified flaw that may allow a remote denial of service. The issue could be triggered when the LDAP dissector frees static memory and crashes, and will result in loss of availability for the application. |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2006-07-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-687.nasl - Type : ACT_GATHER_INFO |
2005-10-11 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-853.nasl - Type : ACT_GATHER_INFO |
2005-10-05 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-131.nasl - Type : ACT_GATHER_INFO |
2005-08-12 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-687.nasl - Type : ACT_GATHER_INFO |
2005-07-31 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-651.nasl - Type : ACT_GATHER_INFO |
2005-07-31 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-655.nasl - Type : ACT_GATHER_INFO |
2005-07-31 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200507-27.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:34:30 |
|