RedHat: 'ethereal' Buffer overflow vulnerability
Summary
Summary
Ethereal is a package designed for monitoring network traffic on yoursystem. Several security issues have been found in Ethereal:Due to improper string and error handling in Ethereal's ASN.1 parser, it ispossible for a malformed SNMP or LDAP packet to cause a memory allocationor buffer overrun error in Ethereal versions before 0.9.2 (CAN-2002-0013CAN-2002-0012)The ASN.1 parser in Ethereal 0.9.2 and earlier allows remote attackers tocause a denial of service (crash) via a certain malformed packet, whichcauses Ethereal to allocate memory incorrectly, possibly due to zero-lengthfields. (CAN-2002-0353)The SMB dissector in Ethereal prior to version 0.9.2 allows remoteattackers to cause a denial of service (crash) or execute arbitrary codevia malformed packets that cause Ethereal to dereference a NULL pointer.(CAN-2002-0401)A buffer overflow in X11 dissector in Ethereal before 0.9.3 allowsremote attackers to cause a denial of service (crash) and possiblyexecute arbitrary code while Ethereal is parsing keysyms. (CAN-2002-0402)The DNS dissector in Ethereal before 0.9.3 allows remote attackers tocause a denial of service (CPU consumption) via a malformed packetthat causes Ethereal to enter an infinite loop. (CAN-2002-0403)A vulnerability in GIOP dissector in Ethereal before 0.9.3 allows remoteattackers to cause a denial of service (memory consumption). (CAN-2002-0404)Users of Ethereal should update to the errata packages containing Etherealversion 0.9.4 which is not vulnerable to these issues.
Solution
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.
Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
5. Bug IDs fixed ( for more info):
6. RPMs required:
Red Hat Linux 7.2:
SRPMS:
i386:
ia64:
Red Hat Linux 7.3:
SRPMS:
i386:
7. Verification:
MD5 sum Package Name
8ab27ce7ccaec617b4e5bee0f6cafc8a 7.2/en/os/SRPMS/ethereal-0.9.4-0.7.2.0.src.rpm
a82a1bf914b31bc283c4786a6d005f5a 7.2/en/os/i386/ethereal-0.9.4-0.7.2.0.i386.rpm
95b0e675cc1be0b5d59a2b3becf2420c 7.2/en/os/i386/ethereal-gnome-0.9.4-0.7.2.0.i386.rpm
c370c2585040f9174ebe6b20def17764 7.2/en/os/ia64/ethereal-0.9.4-0.7.2.0.ia64.rpm
2096533a5f9352ff47b4fd01302b7c92 7.2/en/os/ia64/ethereal-gnome-0.9.4-0.7.2.0.ia64.rpm
70022f6df52ad74013ab2901fe6f0e3d 7.3/en/os/SRPMS/ethereal-0.9.4-0.7.3.0.src.rpm
52a3074dea1e4e9563558e523a659bc5 7.3/en/os/i386/ethereal-0.9.4-0.7.3.0.i386.rpm
1650416f14b9f6a7cb15aa2f38f20bf4 7.3/en/os/i386/ethereal-gnome-0.9.4-0.7.3.0.i386.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key
is available at:
About
You can verify each package with the following command:
rpm --checksig
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg
References
CVE -CVE-2002-0012 CVE -CVE-2002-0013 CVE -CVE-2002-0353 CVE -CVE-2002-0401 CVE -CVE-2002-0402 CVE -CVE-2002-0403 CVE -CVE-2002-0404 Copyright(c) 2000, 2001, 2002 Red Hat, Inc. `
Package List
Topic
Topic
Updated ethereal packages are available which fix several security problems.
Relevant Releases Architectures
Red Hat Linux 7.2 - i386, ia64
Red Hat Linux 7.3 - i386
Bugs Fixed
