Netwosix Linux Advisory: ethereal

---

Netwosix Linux Security Advisory #2004-0007 <http://www.netwosix.org>

---

Package name: ethereal
Summary: Multiple security problems in Ethereal
Date: 2004-03-29
Affected versions: Netwosix 1.0 Netwosix 1.1

Package description:

Ethereal is used by network professionals around the world for
troubleshooting, analysis, software and protocol development, and
education. It has all of the standard features you would expect in
a protocol analyzer, and several features not seen in any other
product. Its open source license allows talented experts in the
networking community to add enhancements. It runs on all popular
computing platforms, including Unix, Linux, and Windows.

Problem description:

Serious issues have been discovered in the following protocol
dissectors:

• Stefan Esser discovered thirteen buffer overflows in the
  following protocol dissectors: NetFlow, IGAP, EIGRP, PGM, IrDA,
  BGP, ISUP, and TCAP. (CAN-2004-0176)
• A zero-length Presentation protocol selector could make
  Ethereal crash. (CAN-2004-0367)
• Jonathan Heussser discovered that a carefully-crafted RADIUS
  packet could cause a crash. (CAN-2004-0365)
• A corrupt color filter file could cause a segmentation
  fault.

Action:

We recommend that all systems with this package installed be
upgraded. Please note that if you do not need the functionality
provided by this package, you may want to remove it from your
system.

Location:

You can download the latest version of this package in NEPOTE
format from: <http://download.netwosix.org/0007/nepote>

Nepote Update

(Nepote has been updated with new ports on 21 March 2004. Update
your portage tree from http://nepote.netwosix.org,
first):

See this instructions to update the port of this package:

        # cd /usr/ports/graphics/ethereal
        # rm nepote
        # wget http://download.netwosix.org/0007/nepote
        # sh nepote (to install the new and updated package)

References

Specific references for this advisory:
http://www.ethereal.com/appnotes/enpa-sa-00013.html

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0176

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0367

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0365

About Linux Netwosix:

Linux Netwosix is a powerful and optimized Linux distribution for
servers and Network Security related jobs. It can also be used for
special operations such as penetration testing with its big
collection of security oriented software and sources. It’s a light
distribution created for the requirements of every SysAdmin and
it’s very portable and highly configurable. Our philosophy is to
give greater liberty for configuration to the SysAdmin. Only in
this way can he/she configure a powerful and stable server machine.
Linux Netwosix also has a powerful ports system (Nepote) similar to
the xBSD systems but more flexible and usable.

Questions?

Check out our mailing lists: <http://www.netwosix.org/mailing.html>

The advisory itself is available at
<http://www.netwosix.org/adv07.html>

---

MD5sums of the packages:
a957fd6cf1b02e9290a795f0433175a7 0007/nepote

Vincenzo Ciaglia – Linux Netwosix Security Advisories
<ciaglia@netwosix.org> –
<http://www.netwosix.org>