PT-2003-1558 · Ethereal · Ethereal

Timo Sirainen · Published 2003-05-30 · Updated 2024-02-16 · CVE-2003-0356

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Ethereal versions 0.9.11 and earlier

Description: Multiple off-by-one vulnerabilities allow remote attackers to cause a denial of service and possibly execute arbitrary code via several dissectors, including AIM, GIOP Gryphon, OSPF, PPTP, Quake, Quake2, Quake3, Rsync, SMB, SMPP, and TSP, which do not properly use the tvb get nstringz and tvb get nstringz0 functions.

Recommendations: For Ethereal versions 0.9.11 and earlier, consider disabling the affected dissectors until a patch is available. Restrict access to the vulnerable functions tvb get nstringz and tvb get nstringz0 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2003-0356

DSA-313

Affected Products

Ethereal

References · 8

• http://ethereal.com/appnotes/enpa-sa-00009.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2003:067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0356 · Security Note
• http://debian.org/security/2003/dsa-313 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-077.html · Vendor Advisory
• https://t.me/cvenotify/71813 · Telegram Post
• http://kb.cert.org/vuls/id/641013 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A69 · Note