SOT Linux Advisory: ethereal

SOT Linux Security Advisory

1.Problem description

Ethereal is a network traffic analyzer for Unix-ish operating systems.

The SMB dissector in Ethereal before 0.10.0 allows remote attackers to cause a denial of service via a malformed SMB packet that triggers a segmentation fault during processing of Selected packets. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CAN-2003-1012 to this issue.

The Q.931 dissector in Ethereal before 0.10.0 allows remote attackers to cause a denial of service (crash) via a malformed Q.931, which triggers a null dereference. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CAN-2003-1013 to this issue. Users of tcpdump should update to these update packages, which contain a backported security patch that corrects this issue.

Users of ethereal should update to these update packages, which contain a backported security patch that corrects this issue.

2. Updated packages

SOT Linux 2003 Server:

i386:
ftp://ftp.sot.com/updates/2003/Server/i386/ethereal-base-0.9.16-4.i386.rpm
ftp://ftp.sot.com/updates/2003/Server/i386/ethereal-kde-0.9.16-4.i386.rpm
ftp://ftp.sot.com/updates/2003/Server/i386/ethereal-gtk+-0.9.16-4.i386.rpm
ftp://ftp.sot.com/updates/2003/Server/i386/ethereal-usermode-0.9.16-4.i386.rpm

SRPMS:
ftp://ftp.sot.com/updates/2003/Server/SRPMS/ethereal-0.9.16-4.src.rpm

3. Upgrading package

Before applying this update, make sure all previously released errata relevant to your system have been applied.

Use up2date to automatically upgrade the fixed packages.

If you want to upgrade manually, download the updated package from the SOT Linux FTP site (use the links above) or from one of our mirrors. The list of mirrors can be obtained at www.sot.com/en/linux

Update the package with the following command: rpm -Uvh <filename>

4. Verification

All packages are PGP signed by SOT for security.

You can verify each package with the following command: rpm --checksig <filename>

If you wish to verify the integrity of the downloaded package, run "md5sum <filename>" and compare the output with data given below.

Package Name MD5 sum

/Server/i386/ethereal-base-0.9.16-4.i386.rpm daa82a521034318cb364151a9d2d281c
/Server/i386/ethereal-gtk+-0.9.16-4.i386.rpm b3b545b3b695c922e6cdbac881ea52ee
/Server/i386/ethereal-kde-0.9.16-4.i386.rpm 0f5646a3d7f61b8441567d74970b533d
/Server/i386/ethereal-usermode-0.9.16-4.i386.rpm 66f22dd2058ff1972e5624492c9217dd
/Server/SRPMS/ethereal-0.9.16-4.src.rpm e9ce066d54785905d69cec3e704ca61d

5. References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-1012
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-1013
http://www.ethereal.com/appnotes/enpa-sa-00012.html

Copyright(c) 2001-2003 SOT