RHSA-2002:088: Updated ethereal packages are available

Description

Updated ethereal packages are available which fix several security problems.

Ethereal is a package designed for monitoring network traffic on your system. Several security issues have been found in Ethereal: Due to improper string and error handling in Ethereal's ASN.1 parser, it is possible for a malformed SNMP or LDAP packet to cause a memory allocation or buffer overrun error in Ethereal versions before 0.9.2 (CAN-2002-0013 CAN-2002-0012) The ASN.1 parser in Ethereal 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a certain malformed packet, which causes Ethereal to allocate memory incorrectly, possibly due to zero-length fields. (CAN-2002-0353) The SMB dissector in Ethereal prior to version 0.9.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via malformed packets that cause Ethereal to dereference a NULL pointer. (CAN-2002-0401) A buffer overflow in X11 dissector in Ethereal before 0.9.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code while Ethereal is parsing keysyms. (CAN-2002-0402) The DNS dissector in Ethereal before 0.9.3 allows remote attackers to cause a denial of service (CPU consumption) via a malformed packet that causes Ethereal to enter an infinite loop. (CAN-2002-0403) A vulnerability in GIOP dissector in Ethereal before 0.9.3 allows remote attackers to cause a denial of service (memory consumption). (CAN-2002-0404) Users of Ethereal should update to the errata packages containing Ethereal version 0.9.4 which is not vulnerable to these issues.