| Revision Date: | 2004-01-05 | Version: | 502 |
| Title: | RHSA-2004:002: ethereal security update (Low) |
| Description: | Ethereal is a program for monitoring network traffic.
Two security issues have been found that affect Ethereal. By exploiting these issues it may be possible to make Ethereal crash by injecting an intentionally malformed packet onto the wire or by convincing someone to read a malformed packet trace file. It is not known if these issues could allow arbitrary code execution.
The SMB dissector in Ethereal before 0.10.0 allows remote attackers to cause a denial of service via a malformed SMB packet that triggers a segmentation fault during processing of Selected packets. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-1012 to this issue.
The Q.931 dissector in Ethereal before 0.10.0 allows remote attackers to cause a denial of service (crash) via a malformed Q.931, which triggers a null dereference. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-1013 to this issue.
Users of Ethereal should update to these erratum packages containing Ethereal version 0.10.0, which is not vulnerable to these issues.
|
| Family: | unix | Class: | patch |
| Status: | | Reference(s): | CVE-2003-1012
CVE-2003-1013
RHSA-2004:002-01
|
| Platform(s): | Red Hat Enterprise Linux 3
| Product(s): | |
| Definition Synopsis |
| Red Hat Enterprise Linux 3 is installed AND Package Information
ethereal-gnome is earlier than 0:0.10.0a-0.30E.1
AND ethereal-gnome is signed with Red Hat master key
OR
ethereal is earlier than 0:0.10.0a-0.30E.1
AND ethereal is signed with Red Hat master key
|