PT-2006-2921 · Ethereal · Ethereal

Gerald Combs · Published 2006-04-25 · Updated 2024-02-14 · CVE-2006-1937

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Ethereal versions 0.10.x up to 0.10.14

Description The issue affects multiple components, including H.248, X.509if, SRVLOC, H.245, AIM, and general packet dissectors, as well as the statistics counter. Remote attackers can cause a denial of service, leading to a crash due to a null dereference.

Recommendations For Ethereal versions 0.10.x up to 0.10.14, consider disabling the affected dissectors, such as H.248, X.509if, SRVLOC, H.245, AIM, and general packet dissectors, until a fix is available. Additionally, restrict access to the statistics counter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2006-1937

DSA-1049-1

RHSA-2006:0420

Affected Products

Ethereal

References · 32

• http://ethereal.com/appnotes/enpa-sa-00023.html · Patch
• ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc · Vendor Advisory
• http://secunia.com/advisories/19839 · Vendor Advisory
• http://secunia.com/advisories/20944 · Vendor Advisory
• http://secunia.com/advisories/19769 · Vendor Advisory
• http://redhat.com/archives/fedora-announce-list/2006-April/msg00194.html · Vendor Advisory
• http://secunia.com/advisories/19962 · Vendor Advisory
• http://secunia.com/advisories/19805 · Vendor Advisory
• http://secunia.com/advisories/20117 · Vendor Advisory
• http://vupen.com/english/advisories/2006/1501 · Vendor Advisory
• http://secunia.com/advisories/19828 · Vendor Advisory
• http://redhat.com/archives/fedora-announce-list/2006-April/msg00195.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1937 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200604-17.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:077 · Vendor Advisory