Vulnerability Bulletins |
Múltiples vulnerabilidades en Ethereal 0.10.4 |
|
Vulnerability classification |
|
Property | Value |
Confidence level | Oficial |
Impact | Obtener acceso |
Dificulty | Experto |
Required attacker level | Acceso remoto sin cuenta a un servicio exotico |
System information |
|
Property | Value |
Affected manufacturer | GNU/Linux |
Affected software | Ethereal >=0.8.15, <=0.10.4 |
Description |
|
Se han descubierto tres vulnerabilidades en las versiones que van desde la 0.8.15 a la 0.10.4, ambas inclusive, de Ethereal. Las vulnerabilidades se describen a continuación: CAN-2004-0633: Vulnerabilidad de desbordamiento de entero en el procesado del protocolo iSNS. La explotación de esta vulnerabilidad podría permitir a un atacante remoto causar una denegación de servicio en Ethereal mediante un paquete iSNS especialmente diseñado. Versiones afectadas: 0.10.3 -0.10.4. CAN-2004-0634: Vulnerabilidad en el procesado del protocolo SMB cuando no hay una política para un manejador y la capacidad para descubrir el SMB SID está activada. La explotación de esta vulnerabilidad podría permitir a un atacante remoto causar una situación de denegación de servicio en Ethereal mediante un paquete SMB especialmente diseñado. Versiones afectadas: 0.9.15 - 0.10.4. CAN-2004-0635: Vulnerabilidad en el procesado del protocolo SNMP. La vulnerabilidad reside en el manejo de cadenas de comunidad especialmente diseñadas. La explotación de esta vulnerabilidad podría permitir a un atacante remoto provocar una situación de denegación de servicio en Ethereal mediante el envío de un paquete SNMP especialmente diseñado. Versiones afectadas: 0.8.15 - 0.10.4. La explotación de estas vulnerabilidades podrían llegar a provocar la ejecución remota de código por parte de un atacante remoto mediante el envío de paquetes especialmente diseñados. |
|
Solution |
|
Si lo desea, aplique los mecanismos de actualización propios de su distribución, o bien baje las fuentes del software y compílelo usted mismo. Actualización de software Ethereal Ethereal0.10.5 http://www.ethereal.com/download.html Mandrake Linux Mandrakelinux 9.2 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/9.2/RPMS/ethereal-0.10.5-0.1.92mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/9.2/SRPMS/ethereal-0.10.5-0.1.92mdk.src.rpm AMD64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/9.2/RPMS/ethereal-0.10.5-0.1.92mdk.amd64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/9.2/SRPMS/ethereal-0.10.5-0.1.92mdk.src.rpm Mandrakelinux 10.0 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/RPMS/ethereal-0.10.5-0.1.100mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/SRPMS/ethereal-0.10.5-0.1.100mdk.src.rpm AMD64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/RPMS/ethereal-0.10.5-0.1.100mdk.amd64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/SRPMS/ethereal-0.10.5-0.1.100mdk.src.rpm Debian Linux Debian Linux 3.0 Source http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4-1woody8.dsc http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4-1woody8.diff.gz http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4.orig.tar.gz Alpha http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4-1woody7_alpha.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-common_0.9.4-1woody7_alpha.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-dev_0.9.4-1woody7_alpha.deb http://security.debian.org/pool/updates/main/e/ethereal/tethereal_0.9.4-1woody7_alpha.deb ARM http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4-1woody8_arm.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-common_0.9.4-1woody8_arm.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-dev_0.9.4-1woody8_arm.deb http://security.debian.org/pool/updates/main/e/ethereal/tethereal_0.9.4-1woody8_arm.deb Intel IA-32 http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4-1woody8_i386.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-common_0.9.4-1woody8_i386.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-dev_0.9.4-1woody8_i386.deb http://security.debian.org/pool/updates/main/e/ethereal/tethereal_0.9.4-1woody8_i386.deb Intel IA-64 http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4-1woody8_ia64.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-common_0.9.4-1woody8_ia64.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-dev_0.9.4-1woody8_ia64.deb http://security.debian.org/pool/updates/main/e/ethereal/tethereal_0.9.4-1woody8_ia64.deb HP Precision http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4-1woody8_hppa.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-common_0.9.4-1woody8_hppa.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-dev_0.9.4-1woody8_hppa.deb http://security.debian.org/pool/updates/main/e/ethereal/tethereal_0.9.4-1woody8_hppa.deb Motorola 680x0 http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4-1woody8_m68k.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-common_0.9.4-1woody8_m68k.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-dev_0.9.4-1woody8_m68k.deb http://security.debian.org/pool/updates/main/e/ethereal/tethereal_0.9.4-1woody8_m68k.deb Big endian MIPS http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4-1woody8_mips.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-common_0.9.4-1woody8_mips.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-dev_0.9.4-1woody8_mips.deb http://security.debian.org/pool/updates/main/e/ethereal/tethereal_0.9.4-1woody8_mips.deb Little endian MIPS http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4-1woody8_mipsel.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-common_0.9.4-1woody8_mipsel.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-dev_0.9.4-1woody8_mipsel.deb http://security.debian.org/pool/updates/main/e/ethereal/tethereal_0.9.4-1woody8_mipsel.deb PowerPC http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4-1woody8_powerpc.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-common_0.9.4-1woody8_powerpc.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-dev_0.9.4-1woody8_powerpc.deb http://security.debian.org/pool/updates/main/e/ethereal/tethereal_0.9.4-1woody8_powerpc.deb IBM S/390 http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4-1woody8_s390.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-common_0.9.4-1woody8_s390.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-dev_0.9.4-1woody8_s390.deb http://security.debian.org/pool/updates/main/e/ethereal/tethereal_0.9.4-1woody8_s390.deb Sun Sparc http://security.debian.org/pool/updates/main/e/ethereal/ethereal_0.9.4-1woody8_sparc.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-common_0.9.4-1woody8_sparc.deb http://security.debian.org/pool/updates/main/e/ethereal/ethereal-dev_0.9.4-1woody8_sparc.deb http://security.debian.org/pool/updates/main/e/ethereal/tethereal_0.9.4-1woody8_sparc.deb Red Hat Linux Red Hat Desktop (v. 3) AMD64 ethereal-0.10.5-0.30E.2.x86_64.rpm ethereal-gnome-0.10.5-0.30E.2.x86_64.rpm SRPMS ethereal-0.10.5-0.30E.2.src.rpm i386 ethereal-0.10.5-0.30E.2.i386.rpm ethereal-gnome-0.10.5-0.30E.2.i386.rpm https://rhn.redhat.com/ Red Hat Enterprise Linux AS (v. 2.1) SRPMS ethereal-0.10.5-0.AS21.2.src.rpm i386 ethereal-0.10.5-0.AS21.2.i386.rpm ethereal-gnome-0.10.5-0.AS21.2.i386.rpm ia64 ethereal-0.10.5-0.AS21.2.ia64.rpm ethereal-gnome-0.10.5-0.AS21.2.ia64.rpm https://rhn.redhat.com/ Red Hat Enterprise Linux AS (v. 3) AMD64 ethereal-0.10.5-0.30E.2.x86_64.rpm ethereal-gnome-0.10.5-0.30E.2.x86_64.rpm SRPMS ethereal-0.10.5-0.30E.2.src.rpm i386 ethereal-0.10.5-0.30E.2.i386.rpm ethereal-gnome-0.10.5-0.30E.2.i386.rpm ia64 ethereal-0.10.5-0.30E.2.ia64.rpm ethereal-gnome-0.10.5-0.30E.2.ia64.rpm ppc ethereal-0.10.5-0.30E.2.ppc.rpm ethereal-gnome-0.10.5-0.30E.2.ppc.rpm s390 ethereal-0.10.5-0.30E.2.s390.rpm ethereal-gnome-0.10.5-0.30E.2.s390.rpm s390x ethereal-0.10.5-0.30E.2.s390x.rpm ethereal-gnome-0.10.5-0.30E.2.s390x.rpm https://rhn.redhat.com/ Red Hat Enterprise Linux ES (v. 2.1) SRPMS ethereal-0.10.5-0.AS21.2.src.rpm i386 ethereal-0.10.5-0.AS21.2.i386.rpm ethereal-gnome-0.10.5-0.AS21.2.i386.rpm https://rhn.redhat.com/ Red Hat Enterprise Linux ES (v. 3) AMD64 ethereal-0.10.5-0.30E.2.x86_64.rpm ethereal-gnome-0.10.5-0.30E.2.x86_64.rpm SRPMS ethereal-0.10.5-0.30E.2.src.rpm i386 ethereal-0.10.5-0.30E.2.i386.rpm ethereal-gnome-0.10.5-0.30E.2.i386.rpm ia64 ethereal-0.10.5-0.30E.2.ia64.rpm ethereal-gnome-0.10.5-0.30E.2.ia64.rpm https://rhn.redhat.com/ Red Hat Enterprise Linux WS (v. 2.1) SRPMS ethereal-0.10.5-0.AS21.2.src.rpm i386 ethereal-0.10.5-0.AS21.2.i386.rpm ethereal-gnome-0.10.5-0.AS21.2.i386.rpm https://rhn.redhat.com/ Red Hat Enterprise Linux WS (v. 3) AMD64 ethereal-0.10.5-0.30E.2.x86_64.rpm ethereal-gnome-0.10.5-0.30E.2.x86_64.rpm SRPMS ethereal-0.10.5-0.30E.2.src.rpm i386 ethereal-0.10.5-0.30E.2.i386.rpm ethereal-gnome-0.10.5-0.30E.2.i386.rpm ia64 ethereal-0.10.5-0.30E.2.ia64.rpm ethereal-gnome-0.10.5-0.30E.2.ia64.rpm https://rhn.redhat.com/ Red Hat Linux Advanced Workstation 2.1 Itanium Processor SRPMS ethereal-0.10.5-0.AS21.2.src.rpm ia64 ethereal-0.10.5-0.AS21.2.ia64.rpm ethereal-gnome-0.10.5-0.AS21.2.ia64.rpm https://rhn.redhat.com/ |
|
Standar resources |
|
Property | Value |
CVE |
CAN-2004-0633 CAN-2004-0634 CAN-2004-0635 |
BID | |
Other resources |
|
Ethereal Security Advisory enpa-sa-00015 http://www.ethereal.com/appnotes/enpa-sa-00015.html Mandrakesoft Security Advisory http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:067 Debian Security Advisory DSA 528-1 http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00129.html Red Hat Security Advisory RHSA-2004:378-09 https://rhn.redhat.com/errata/RHSA-2004-378.html |
Version history |
||
Version | Comments | Date |
1.0 | Aviso emitido | 2004-07-12 |
1.1 | Aviso emitido por Debian (DSA 528-1) | 2004-07-19 |
1.2 | Aviso emitido por Red Hat (RHSA-2004:378-08) | 2004-08-09 |
1.3 | Aviso actualizado por Red Hat (RHSA-2004:378-09) | 2004-09-29 |