Rapid7 Vulnerability & Exploit Database

RHSA-2002:290: Updated Ethereal packages are available

Back to Search

RHSA-2002:290: Updated Ethereal packages are available

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
12/23/2002
Created
07/25/2018
Added
10/28/2005
Modified
07/04/2017

Description

Updated Ethereal packages are available which fix various security issues.

Ethereal is a package designed for monitoring network traffic on your system. Several security issues have been found in the Ethereal packages distributed with Red Hat Linux versions 7.2, 7.3, and 8.0 Multiple integer signedness errors in the BGP dissector in Ethereal 0.9.7 and earlier allow remote attackers to cause a denial of service (infinite loop) via malformed messages. This problem was discovered by Silvio Cesare. CAN-2002-1355 Ethereal 0.9.7 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed packets to the LMP, PPP, or TDS dissectors. CAN-2002-1356 Users of Ethereal should update to the erratum packages containing Ethereal version 0.9.8 which is not vulnerable to these issues.

Solution(s)

  • redhat-upgrade-ethereal
  • redhat-upgrade-ethereal-gnome

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;