Updated Ethereal packages are available which fix various security issues. [Updated 06 Feb 2003] Added fixed packages for Advanced Workstation 2.1
Ethereal is a package designed for monitoring network traffic on your system. Several security issues have been found in the Ethereal packages distributed with CentOS Linux Advanced Server 2.1. Multiple errors involving signed integers in the BGP dissector in Ethereal 0.9.7 and earlier allow remote attackers to cause a denial of service (infinite loop) via malformed messages. This problem was discovered by Silvio Cesare. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1355 to this issue. Ethereal 0.9.7 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed packets to the LMP, PPP, or TDS dissectors. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1356 to this issue. Users of Ethereal should update to the errata packages containing Ethereal version 0.9.8 which is not vulnerable to these issues.