Vulnerabilities > CVE-2004-1140 - Unspecified vulnerability in Ethereal Group Ethereal

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN

Summary

Ethereal 0.9.0 through 0.10.7 allows remote attackers to cause a denial of service (application hang) and possibly fill available disk space via an invalid RTP timestamp.

Nessus

  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2005-037.NASL
    descriptionUpdated Ethereal packages that fix various security vulnerabilities are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ethereal is a program for monitoring network traffic. A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws. A flaw in the DICOM dissector could cause a crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1139 to this issue. A invalid RTP timestamp could hang Ethereal and create a large temporary file, possibly filling available disk space. (CVE-2004-1140) The HTTP dissector could access previously-freed memory, causing a crash. (CVE-2004-1141) An improperly formatted SMB packet could make Ethereal hang, maximizing CPU utilization. (CVE-2004-1142) The COPS dissector could go into an infinite loop. (CVE-2005-0006) The DLSw dissector could cause an assertion, making Ethereal exit prematurely. (CVE-2005-0007) The DNP dissector could cause memory corruption. (CVE-2005-0008) The Gnutella dissector could cause an assertion, making Ethereal exit prematurely. (CVE-2005-0009) The MMSE dissector could free static memory, causing a crash. (CVE-2005-0010) The X11 protocol dissector is vulnerable to a string buffer overflow. (CVE-2005-0084) Users of Ethereal should upgrade to these updated packages which contain version 0.10.9 that is not vulnerable to these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id17171
    published2005-02-22
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/17171
    titleRHEL 4 : ethereal (RHSA-2005:037)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2005:037. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(17171);
      script_version ("1.23");
      script_cvs_date("Date: 2019/10/25 13:36:10");
    
      script_cve_id("CVE-2004-1139", "CVE-2004-1140", "CVE-2004-1141", "CVE-2004-1142", "CVE-2005-0006", "CVE-2005-0007", "CVE-2005-0008", "CVE-2005-0009", "CVE-2005-0010", "CVE-2005-0084");
      script_xref(name:"RHSA", value:"2005:037");
    
      script_name(english:"RHEL 4 : ethereal (RHSA-2005:037)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated Ethereal packages that fix various security vulnerabilities
    are now available for Red Hat Enterprise Linux 4.
    
    This update has been rated as having moderate security impact by the
    Red Hat Security Response Team.
    
    Ethereal is a program for monitoring network traffic.
    
    A number of security flaws have been discovered in Ethereal. On a
    system where Ethereal is running, a remote attacker could send
    malicious packets to trigger these flaws.
    
    A flaw in the DICOM dissector could cause a crash. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
    name CVE-2004-1139 to this issue.
    
    A invalid RTP timestamp could hang Ethereal and create a large
    temporary file, possibly filling available disk space. (CVE-2004-1140)
    
    The HTTP dissector could access previously-freed memory, causing a
    crash. (CVE-2004-1141)
    
    An improperly formatted SMB packet could make Ethereal hang,
    maximizing CPU utilization. (CVE-2004-1142)
    
    The COPS dissector could go into an infinite loop. (CVE-2005-0006)
    
    The DLSw dissector could cause an assertion, making Ethereal exit
    prematurely. (CVE-2005-0007)
    
    The DNP dissector could cause memory corruption. (CVE-2005-0008)
    
    The Gnutella dissector could cause an assertion, making Ethereal exit
    prematurely. (CVE-2005-0009)
    
    The MMSE dissector could free static memory, causing a crash.
    (CVE-2005-0010)
    
    The X11 protocol dissector is vulnerable to a string buffer overflow.
    (CVE-2005-0084)
    
    Users of Ethereal should upgrade to these updated packages which
    contain version 0.10.9 that is not vulnerable to these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-1139"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-1140"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-1141"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-1142"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0006"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0007"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0008"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0009"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0010"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-0084"
      );
      # http://www.ethereal.com/appnotes/enpa-sa-00016.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://ethereal.archive.sunet.se/appnotes/enpa-sa-00016.html"
      );
      # http://www.ethereal.com/appnotes/enpa-sa-00017.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://ethereal.archive.sunet.se/appnotes/enpa-sa-00017.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2005:037"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected ethereal and / or ethereal-gnome packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ethereal");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ethereal-gnome");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2004/12/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2005/02/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/02/22");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^4([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 4.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2005:037";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL4", reference:"ethereal-0.10.9-1.EL4.1")) flag++;
      if (rpm_check(release:"RHEL4", reference:"ethereal-gnome-0.10.9-1.EL4.1")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ethereal / ethereal-gnome");
      }
    }
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_EFA1344B547711D9A9E70001020EED82.NASL
    descriptionAn Ethreal Security Advisories reports : Issues have been discovered in the following protocol dissectors : - Matthew Bing discovered a bug in DICOM dissection that could make Ethereal crash. - An invalid RTP timestamp could make Ethereal hang and create a large temporary file, possibly filling available disk space. - The HTTP dissector could access previously-freed memory, causing a crash. - Brian Caswell discovered that an improperly formatted SMB packet could make Ethereal hang, maximizing CPU utilization. Impact: It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
    last seen2020-06-01
    modified2020-06-02
    plugin id19163
    published2005-07-13
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/19163
    titleFreeBSD : ethereal -- multiple vulnerabilities (efa1344b-5477-11d9-a9e7-0001020eed82)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2004-152.NASL
    descriptionA number of vulnerabilities were discovered in Ethereal : - Matthew Bing discovered a bug in DICOM dissection that could make Ethereal crash (CVE-2004-1139) - An invalid RTP timestamp could make Ethereal hang and create a large temporary file, possibly filling available disk space (CVE-2004-1140) - The HTTP dissector could access previously-freed memory, causing a crash (CVE-2004-1141) - Brian Caswell discovered that an improperly formatted SMB packet could make Ethereal hang, maximizing CPU utilization (CVE-2004-1142) Ethereal 0.10.8 was released to correct these problems and is being provided.
    last seen2020-06-01
    modified2020-06-02
    plugin id16014
    published2004-12-21
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/16014
    titleMandrake Linux Security Advisory : ethereal (MDKSA-2004:152)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2005-011.NASL
    descriptionUpdated Ethereal packages that fix various security vulnerabilities are now available. Ethereal is a program for monitoring network traffic. A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws. A flaw in the DICOM dissector could cause a crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1139 to this issue. A invalid RTP timestamp could hang Ethereal and create a large temporary file, possibly filling available disk space. (CVE-2004-1140) The HTTP dissector could access previously-freed memory, causing a crash. (CVE-2004-1141) An improperly formatted SMB packet could make Ethereal hang, maximizing CPU utilization. (CVE-2004-1142) The COPS dissector could go into an infinite loop. (CVE-2005-0006) The DLSw dissector could cause an assertion, making Ethereal exit prematurely. (CVE-2005-0007) The DNP dissector could cause memory corruption. (CVE-2005-0008) The Gnutella dissector could cause an assertion, making Ethereal exit prematurely. (CVE-2005-0009) The MMSE dissector could free static memory, causing a crash. (CVE-2005-0010) The X11 protocol dissector is vulnerable to a string buffer overflow. (CVE-2005-0084) Users of Ethereal should upgrade to these updated packages which contain version 0.10.9 that is not vulnerable to these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id16295
    published2005-02-02
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/16295
    titleRHEL 2.1 / 3 : ethereal (RHSA-2005:011)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200412-15.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200412-15 (Ethereal: Multiple vulnerabilities) There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.8, including: Bug in DICOM dissection discovered by Bing could make Ethereal crash (CAN 2004-1139). An invalid RTP timestamp could make Ethereal hang and create a large temporary file (CAN 2004-1140). The HTTP dissector could access previously-freed memory (CAN 2004-1141). Brian Caswell discovered that an improperly formatted SMB could make Ethereal hang (CAN 2004-1142). Impact : An attacker might be able to use these vulnerabilities to crash Ethereal, perform DoS by CPU and disk space utilization or even execute arbitrary code with the permissions of the user running Ethereal, which could be the root user. Workaround : For a temporary workaround you can disable all affected protocol dissectors by selecting Analyze->Enabled Protocols... and deselecting them from the list. However, it is strongly recommended to upgrade to the latest stable version.
    last seen2020-06-01
    modified2020-06-02
    plugin id16002
    published2004-12-19
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/16002
    titleGLSA-200412-15 : Ethereal: Multiple vulnerabilities

Oval

accepted2013-04-29T04:06:03.712-04:00
classvulnerability
contributors
  • nameAharon Chernin
    organizationSCAP.com, LLC
  • nameDragos Prisaca
    organizationG2, Inc.
definition_extensions
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 3
    ovaloval:org.mitre.oval:def:11782
  • commentCentOS Linux 3.x
    ovaloval:org.mitre.oval:def:16651
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 4
    ovaloval:org.mitre.oval:def:11831
  • commentCentOS Linux 4.x
    ovaloval:org.mitre.oval:def:16636
  • commentOracle Linux 4.x
    ovaloval:org.mitre.oval:def:15990
descriptionEthereal 0.9.0 through 0.10.7 allows remote attackers to cause a denial of service (application hang) and possibly fill available disk space via an invalid RTP timestamp.
familyunix
idoval:org.mitre.oval:def:10484
statusaccepted
submitted2010-07-09T03:56:16-04:00
titleEthereal 0.9.0 through 0.10.7 allows remote attackers to cause a denial of service (application hang) and possibly fill available disk space via an invalid RTP timestamp.
version26

Redhat

advisories
rhsa
idRHSA-2005:037
rpms
  • ethereal-0:0.10.9-1.EL3.1
  • ethereal-debuginfo-0:0.10.9-1.EL3.1
  • ethereal-gnome-0:0.10.9-1.EL3.1