Gentoo: ethereal Arbitrary code execution
The SOCKS dissector in Ethereal 0.9.9 is susceptible to a formatstring overflow
Summary
- --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200303-10 - ---------------------------------------------------------------------
- ---------------------------------------------------------------------
>From advisory: "The SOCKS dissector in Ethereal 0.9.9 is susceptible to a format string overflow. This vulnerability has been present in Ethereal since the SOCKS dissector was introduced in version 0.8.7. It was discovered by Georgi Guninski. Additionally, the NTLMSSP code is susceptible to a heap overflow. All users of Ethereal 0.9.9 and below are encouraged to upgrade. "
Read the full advisory at:
SOLUTION
It is recommended that all Gentoo Linux users who are running net-analyzer/ethereal upgrade to ethereal-0.9.10 as follows:
emerge sync emerge ethereal emerge clean
- --------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at - ---------------------------------------------------------------------
0.9.10
Resolution
References
Availability
Concerns
Severity
PACKAGE : ethereal
SUMMARY : arbitrary code execution
DATE : 2003-03-09 20:12 UTC
EXPLOIT : remote
VERSIONS AFFECTED : <0.9.10 : fixed version>=0.9.10
CVE :
