Lucene search

K
freebsdFreeBSD5D51D245-00CA-11DA-BC08-0001020EED82
HistoryJul 26, 2005 - 12:00 a.m.

ethereal -- multiple protocol dissectors vulnerabilities

2005-07-2600:00:00
vuxml.freebsd.org
7

An Ethreal Security Advisories reports:

Our testing program has turned up several more security
issues:

The LDAP dissector could free static memory and crash.
The AgentX dissector could crash.
The 802.3 dissector could go into an infinite loop.
The PER dissector could abort.
The DHCP dissector could go into an infinite loop.
The BER dissector could abort or loop infinitely.
The MEGACO dissector could go into an infinite loop.
The GIOP dissector could dereference a null pointer.
The SMB dissector was susceptible to a buffer overflow.
The WBXML could dereference a null pointer.
The H1 dissector could go into an infinite loop.
The DOCSIS dissector could cause a crash.
The SMPP dissector could go into an infinite loop.
SCTP graphs could crash.
The HTTP dissector could crash.
The SMB dissector could go into a large loop.
The DCERPC dissector could crash.
Several dissectors could crash while reassembling packets.

Steve Grubb at Red Hat found the following issues:

The CAMEL dissector could dereference a null pointer.
The DHCP dissector could crash.
The CAMEL dissector could crash.
The PER dissector could crash.
The RADIUS dissector could crash.
The Telnet dissector could crash.
The IS-IS LSP dissector could crash.
The NCP dissector could crash.

iDEFENSE found the following issues:

Several dissectors were susceptible to a format string
overflow.

Impact:
It may be possible to make Ethereal crash, use up
available memory, or run arbitrary code by injecting a
purposefully malformed packet onto the wire or by
convincing someone to read a malformed packet trace
file.