Search...

Ethereal RSVP Dissector Malformed Packet Core Dump DoS

2002-06-28T09:43:00

ID OSVDB:6921
Type osvdb
Reporter OSVDB
Modified 2002-06-28T09:43:00

Description

Solution Description

Upgrade to version 0.9.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

References:

Related OSVDB ID: 4474 Related OSVDB ID: 4475 Related OSVDB ID: 6923 Related OSVDB ID: 4476 Related OSVDB ID: 6922 Generic Informational URL: http://www.ethereal.com/appnotes/enpa-sa-00005.html CVE-2002-0834 CVE-2002-0821 CVE-2002-0822

JSON Vulners Source

Initial Source

{"edition": 1, "title": "Ethereal RSVP Dissector Malformed Packet Core Dump DoS", "bulletinFamily": "software", "published": "2002-06-28T09:43:00", "lastseen": "2017-04-28T13:20:01", "history": [], "modified": "2002-06-28T09:43:00", "reporter": "OSVDB", "hash": "8df8e5a20896a5365a7c1fcc24b3b91170248749116b078b6c076f26dfd6c7a6", "viewCount": 0, "href": "https://vulners.com/osvdb/OSVDB:6921", "description": "## Solution Description\nUpgrade to version 0.9.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## References:\n[Related OSVDB ID: 4474](https://vulners.com/osvdb/OSVDB:4474)\n[Related OSVDB ID: 4475](https://vulners.com/osvdb/OSVDB:4475)\n[Related OSVDB ID: 6923](https://vulners.com/osvdb/OSVDB:6923)\n[Related OSVDB ID: 4476](https://vulners.com/osvdb/OSVDB:4476)\n[Related OSVDB ID: 6922](https://vulners.com/osvdb/OSVDB:6922)\nGeneric Informational URL: http://www.ethereal.com/appnotes/enpa-sa-00005.html\n[CVE-2002-0834](https://vulners.com/cve/CVE-2002-0834)\n[CVE-2002-0821](https://vulners.com/cve/CVE-2002-0821)\n[CVE-2002-0822](https://vulners.com/cve/CVE-2002-0822)\n", "affectedSoftware": [], "type": "osvdb", "hashmap": [{"key": "affectedSoftware", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "a079cd423e535a8e267580811350c130"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "description", "hash": "566c52c91ed8d90e525b48c28a4460da"}, {"key": "href", "hash": "cffcc3e77eaeeca385c9addacad8f457"}, {"key": "modified", "hash": "55aaabab1d643727f4054934a3739819"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "55aaabab1d643727f4054934a3739819"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "955b328dc7cd615c13af5464c9183464"}, {"key": "title", "hash": "bad496dcb00d409caf8bf1abefe86472"}, {"key": "type", "hash": "1327ac71f7914948578f08c54f772b10"}], "references": [], "objectVersion": "1.2", "enchantments": {"vulnersScore": 5.0}, "cvss": {"vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/", "score": 7.5}, "cvelist": ["CVE-2002-0821", "CVE-2002-0822", "CVE-2002-0834"], "id": "OSVDB:6921"}

{"result": {"cve": [{"id": "CVE-2002-0821", "type": "cve", "title": "CVE-2002-0821", "description": "Buffer overflows in Ethereal 0.9.4 and earlier allow remote attackers to cause a denial of service or execute arbitrary code via (1) the BGP dissector, or (2) the WCP dissector.", "published": "2002-08-12T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0821", "cvelist": ["CVE-2002-0821"], "lastseen": "2016-09-03T03:27:59"}, {"id": "CVE-2002-0822", "type": "cve", "title": "CVE-2002-0822", "description": "Ethereal 0.9.4 and earlier allows remote attackers to cause a denial of service and possibly excecute arbitrary code via the (1) SOCKS, (2) RSVP, (3) AFS, or (4) LMP dissectors, which can be caused to core dump.", "published": "2002-08-12T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0822", "cvelist": ["CVE-2002-0822"], "lastseen": "2016-09-03T03:28:01"}, {"id": "CVE-2002-0834", "type": "cve", "title": "CVE-2002-0834", "description": "Buffer overflow in the ISIS dissector for Ethereal 0.9.5 and earlier allows remote attackers to cause a denial of service or execute arbitrary code via malformed packets.", "published": "2002-09-24T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0834", "cvelist": ["CVE-2002-0834"], "lastseen": "2016-09-03T03:28:14"}], "osvdb": [{"id": "OSVDB:4474", "type": "osvdb", "title": "Ethereal ISIS Dissector Remote Overflow", "description": "## Solution Description\nUpgrade to version 0.9.6 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## References:\n[Vendor Specific Advisory URL](http://www.ethereal.com/appnotes/enpa-sa-00006.html)\n[Related OSVDB ID: 4475](https://vulners.com/osvdb/OSVDB:4475)\n[Related OSVDB ID: 4476](https://vulners.com/osvdb/OSVDB:4476)\n[CVE-2002-0834](https://vulners.com/cve/CVE-2002-0834)\n[CVE-2002-0821](https://vulners.com/cve/CVE-2002-0821)\n[CVE-2002-0822](https://vulners.com/cve/CVE-2002-0822)\n", "published": "2002-08-20T09:43:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:4474", "cvelist": ["CVE-2002-0821", "CVE-2002-0822", "CVE-2002-0834"], "lastseen": "2017-04-28T13:19:59"}, {"id": "OSVDB:4476", "type": "osvdb", "title": "Ethereal BGP Dissector Remote Overflow", "description": "## Solution Description\nUpgrade to version 0.9.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## References:\n[Related OSVDB ID: 4474](https://vulners.com/osvdb/OSVDB:4474)\n[Related OSVDB ID: 4475](https://vulners.com/osvdb/OSVDB:4475)\n[Related OSVDB ID: 6920](https://vulners.com/osvdb/OSVDB:6920)\nGeneric Informational URL: http://www.ethereal.com/appnotes/enpa-sa-00005.html\n[CVE-2002-0834](https://vulners.com/cve/CVE-2002-0834)\n[CVE-2002-0821](https://vulners.com/cve/CVE-2002-0821)\n[CVE-2002-0822](https://vulners.com/cve/CVE-2002-0822)\n", "published": "2002-06-28T09:43:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:4476", "cvelist": ["CVE-2002-0821", "CVE-2002-0822", "CVE-2002-0834"], "lastseen": "2017-04-28T13:19:59"}, {"id": "OSVDB:6923", "type": "osvdb", "title": "Ethereal LMP Dissector Malformed Packet Core Dump DoS", "description": "## Solution Description\nUpgrade to version 0.9.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## References:\n[Related OSVDB ID: 4474](https://vulners.com/osvdb/OSVDB:4474)\n[Related OSVDB ID: 4475](https://vulners.com/osvdb/OSVDB:4475)\n[Related OSVDB ID: 4476](https://vulners.com/osvdb/OSVDB:4476)\n[Related OSVDB ID: 6921](https://vulners.com/osvdb/OSVDB:6921)\n[Related OSVDB ID: 6922](https://vulners.com/osvdb/OSVDB:6922)\nGeneric Informational URL: http://www.ethereal.com/appnotes/enpa-sa-00005.html\n[CVE-2002-0834](https://vulners.com/cve/CVE-2002-0834)\n[CVE-2002-0821](https://vulners.com/cve/CVE-2002-0821)\n[CVE-2002-0822](https://vulners.com/cve/CVE-2002-0822)\n", "published": "2002-06-28T09:43:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:6923", "cvelist": ["CVE-2002-0821", "CVE-2002-0822", "CVE-2002-0834"], "lastseen": "2017-04-28T13:20:01"}, {"id": "OSVDB:6920", "type": "osvdb", "title": "Ethereal WCP Dissector Large Frame Overflow", "description": "## Solution Description\nUpgrade to version 0.9.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## References:\n[Related OSVDB ID: 4474](https://vulners.com/osvdb/OSVDB:4474)\n[Related OSVDB ID: 4475](https://vulners.com/osvdb/OSVDB:4475)\n[Related OSVDB ID: 4476](https://vulners.com/osvdb/OSVDB:4476)\nGeneric Informational URL: http://www.ethereal.com/appnotes/enpa-sa-00005.html\n[CVE-2002-0834](https://vulners.com/cve/CVE-2002-0834)\n[CVE-2002-0821](https://vulners.com/cve/CVE-2002-0821)\n[CVE-2002-0822](https://vulners.com/cve/CVE-2002-0822)\n", "published": "2002-06-28T09:43:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:6920", "cvelist": ["CVE-2002-0821", "CVE-2002-0822", "CVE-2002-0834"], "lastseen": "2017-04-28T13:20:01"}, {"id": "OSVDB:6922", "type": "osvdb", "title": "Ethereal AFS Dissector Malformed Packet Core Dump DoS", "description": "## Solution Description\nUpgrade to version 0.9.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## References:\n[Related OSVDB ID: 4474](https://vulners.com/osvdb/OSVDB:4474)\n[Related OSVDB ID: 4475](https://vulners.com/osvdb/OSVDB:4475)\n[Related OSVDB ID: 6923](https://vulners.com/osvdb/OSVDB:6923)\n[Related OSVDB ID: 4476](https://vulners.com/osvdb/OSVDB:4476)\n[Related OSVDB ID: 6921](https://vulners.com/osvdb/OSVDB:6921)\nGeneric Informational URL: http://www.ethereal.com/appnotes/enpa-sa-00005.html\n[CVE-2002-0834](https://vulners.com/cve/CVE-2002-0834)\n[CVE-2002-0821](https://vulners.com/cve/CVE-2002-0821)\n[CVE-2002-0822](https://vulners.com/cve/CVE-2002-0822)\n", "published": "2002-06-28T09:43:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:6922", "cvelist": ["CVE-2002-0821", "CVE-2002-0822", "CVE-2002-0834"], "lastseen": "2017-04-28T13:20:01"}, {"id": "OSVDB:4475", "type": "osvdb", "title": "Ethereal SOCKS Dissector Malformed Packet Core Dump DoS", "description": "## Solution Description\nUpgrade to version 0.9.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## References:\n[Related OSVDB ID: 4474](https://vulners.com/osvdb/OSVDB:4474)\n[Related OSVDB ID: 6923](https://vulners.com/osvdb/OSVDB:6923)\n[Related OSVDB ID: 4476](https://vulners.com/osvdb/OSVDB:4476)\n[Related OSVDB ID: 6921](https://vulners.com/osvdb/OSVDB:6921)\n[Related OSVDB ID: 6922](https://vulners.com/osvdb/OSVDB:6922)\nGeneric Informational URL: http://www.ethereal.com/appnotes/enpa-sa-00005.html\n[CVE-2002-0834](https://vulners.com/cve/CVE-2002-0834)\n[CVE-2002-0821](https://vulners.com/cve/CVE-2002-0821)\n[CVE-2002-0822](https://vulners.com/cve/CVE-2002-0822)\n", "published": "2002-06-28T09:43:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:4475", "cvelist": ["CVE-2002-0821", "CVE-2002-0822", "CVE-2002-0834"], "lastseen": "2017-04-28T13:19:59"}], "nessus": [{"id": "REDHAT-RHSA-2002-170.NASL", "type": "nessus", "title": "RHEL 2.1 : ethereal (RHSA-2002:170)", "description": "Updated ethereal packages are available which fix several security problems.\n\nEthereal is a package designed for monitoring network traffic on your system. Several security issues have been found in the Ethereal packages distributed with Red Hat Linux Advanced Server :\n\nBuffer overflow in Ethereal 0.9.5 and earlier allows remote attackers to cause a denial of service or execute arbitrary code via the ISIS dissector. (CVE-2002-0834)\n\nBuffer overflows in Ethereal 0.9.4 and earlier allows remote attackers to cause a denial of service or execute arbitrary code via (1) the BGP dissector, or (2) the WCP dissector. (CVE-2002-0821)\n\nEthereal 0.9.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) SOCKS, (2) RSVP, (3) AFS, or (4) LMP dissectors, which can be caused to core dump (CVE-2002-0822)\n\nA buffer overflow in the X11 dissector in Ethereal before 0.9.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code while Ethereal is parsing keysyms.\n(CVE-2002-0402)\n\nThe DNS dissector in Ethereal before 0.9.4 allows remote attackers to cause a denial of service (CPU consumption) via a malformed packet that causes Ethereal to enter an infinite loop. (CVE-2002-0403)\n\nA vulnerability in the GIOP dissector in Ethereal before 0.9.4 allows remote attackers to cause a denial of service (memory consumption).\n(CVE-2002-0404)\n\nUsers of Ethereal should update to the errata packages containing Ethereal version 0.9.6 which is not vulnerable to these issues.", "published": "2004-07-06T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=12319", "cvelist": ["CVE-2002-0403", "CVE-2002-0821", "CVE-2002-0822", "CVE-2002-0404", "CVE-2002-0402", "CVE-2002-0834"], "lastseen": "2017-10-29T13:35:35"}, {"id": "DEBIAN_DSA-162.NASL", "type": "nessus", "title": "Debian DSA-162-1 : ethereal - buffer overflow", "description": "Ethereal developers discovered a buffer overflow in the ISIS protocol dissector. It may be possible to make Ethereal crash or hang by injecting a purposefully malformed packet onto the wire, or by convincing someone to read a malformed packet trace file. It may be possible to make Ethereal run arbitrary code by exploiting the buffer and pointer problems.", "published": "2004-09-29T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=14999", "cvelist": ["CVE-2002-0834"], "lastseen": "2017-10-29T13:33:12"}], "debian": [{"id": "DSA-162", "type": "debian", "title": "ethereal -- buffer overflow", "description": "Ethereal developers discovered a buffer overflow in the ISIS protocol dissector. It may be possible to make Ethereal crash or hang by injecting a purposefully malformed packet onto the wire, or by convincing someone to read a malformed packet trace file. It may be possible to make Ethereal run arbitrary code by exploiting the buffer and pointer problems.\n\nThis problem has been fixed in version 0.9.4-1woody2 for the current stable distribution (woody), in version 0.8.0-4potato.1 for the old stable distribution (potato) and in version 0.9.6-1 for the unstable distribution (sid).\n\nWe recommend that you upgrade your ethereal packages.", "published": "2002-09-06T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://www.debian.org/security/dsa-162", "cvelist": ["CVE-2002-0834"], "lastseen": "2016-09-02T18:37:11"}], "openvas": [{"id": "OPENVAS:53729", "type": "openvas", "title": "Debian Security Advisory DSA 162-1 (ethereal)", "description": "The remote host is missing an update to ethereal\nannounced via advisory DSA 162-1.", "published": "2008-01-17T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=53729", "cvelist": ["CVE-2002-0834"], "lastseen": "2017-07-24T12:50:19"}]}}