|
|
Family: Red Hat Local Security Checks --> Category: infos
RHSA-2004-002: ethereal Vulnerability Scan
Vulnerability Scan Summary
Check for the version of the ethereal packages
Detailed Explanation for this Vulnerability Test
Updated Ethereal packages that fix two security vulnerabilities are now
available.
Ethereal is a program for monitoring network traffic.
Two security issues have been found that affect Ethereal. By exploiting
these issues it may be possible to make Ethereal crash by injecting an
intentionally malformed packet onto the wire or by convincing someone to
read a malformed packet trace file. It is not known if these issues could
allow arbitrary code execution.
The SMB dissector in Ethereal before 0.10.0 allows remote attackers to
cause a denial of service via a malformed SMB packet that triggers a
segmentation fault during processing of Selected packets. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CVE-2003-1012 to this issue.
The Q.931 dissector in Ethereal before 0.10.0 allows remote attackers to
cause a denial of service (crash) via a malformed Q.931, which triggers a
null dereference. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2003-1013 to this issue.
Users of Ethereal should update to these erratum packages containing
Ethereal version 0.10.0, which is not vulnerable to these issues.
Solution : http://rhn.redhat.com/errata/RHSA-2004-002.html
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
