Rapid7 Vulnerability & Exploit Database

RHSA-2002:291: ethereal security update

Back to Search

RHSA-2002:291: ethereal security update

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
12/23/2002
Created
07/25/2018
Added
10/28/2005
Modified
07/12/2017

Description

Updated Ethereal packages are available which fix various security issues. [Updated 06 Feb 2003] Added fixed packages for Advanced Workstation 2.1

Ethereal is a package designed for monitoring network traffic on your system. Several security issues have been found in the Ethereal packages distributed with Red Hat Linux Advanced Server 2.1. Multiple errors involving signed integers in the BGP dissector in Ethereal 0.9.7 and earlier allow remote attackers to cause a denial of service (infinite loop) via malformed messages. This problem was discovered by Silvio Cesare. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1355 to this issue. Ethereal 0.9.7 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed packets to the LMP, PPP, or TDS dissectors. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1356 to this issue. Users of Ethereal should update to the errata packages containing Ethereal version 0.9.8 which is not vulnerable to these issues.

Solution(s)

  • redhat-upgrade-ethereal
  • redhat-upgrade-ethereal-gnome

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;