PT-2003-1558 · Ethereal · Ethereal

Timo Sirainen · Publicado 2003-05-30 · Atualizado 2024-02-16 · CVE-2003-0356

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Ethereal versions 0.9.11 and earlier

Description: Multiple off-by-one vulnerabilities allow remote attackers to cause a denial of service and possibly execute arbitrary code via several dissectors, including AIM, GIOP Gryphon, OSPF, PPTP, Quake, Quake2, Quake3, Rsync, SMB, SMPP, and TSP, which do not properly use the tvb get nstringz and tvb get nstringz0 functions.

Recommendations: For Ethereal versions 0.9.11 and earlier, consider disabling the affected dissectors until a patch is available. Restrict access to the vulnerable functions tvb get nstringz and tvb get nstringz0 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-193

Identificadores relacionados

CVE-2003-0356

DSA-313

Produtos afetados

Ethereal

Referências · 8

• http://ethereal.com/appnotes/enpa-sa-00009.html · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDKSA-2003:067 · Aviso do Fabricante
• https://t.me/cvenotify/71813 · Publicação no Telegram
• http://kb.cert.org/vuls/id/641013 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0356 · Nota de Segurança
• http://debian.org/security/2003/dsa-313 · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2003-077.html · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A69 · Nota