Name: Multiple problems in Ethereal versions 0.9.1 to 0.10.9

Docid: enpa-sa-00018

Date: March 11, 2005

Versions affected: 0.9.1 up to and including 0.10.9

Severity: High

Description:

Issues have been discovered in the following protocol dissectors:

• Matevz Pustisek discovered a buffer overflow in the Etheric dissector. Versions affected: 0.10.7 to 0.10.9
  CVE: CAN-2005-0704
  
  
• The GPRS-LLC dissector could crash if the "ignore cipher bit" option was enabled. Versions affected: 0.10.7 - 0.10.9
  CVE: CAN-2005-0705
  
  
• Diego Giago discovered a buffer overflow in the 3GPP2 A11 dissector. This flaw was later reported by Leon Juranic. Versions affected: 0.10.3 - 0.10.9
  CVE: CAN-2005-0699
  
  
• Leon Juranic discovered a buffer overflow in the IAPP dissector.
  CVE: CAN-2005-0739
  Versions affected: 0.9.1 to 0.10.9.
  
• A bug in the JXTA dissector could make Ethereal crash.
  Versions affected: 0.10.9.
  
• A bug in the sFlow dissector could make Ethereal crash.
  Versions affected: 0.9.14 to 0.10.9.
  

Impact:

It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

Resolution:

Upgrade to 0.10.10.

If you are running a version prior to 0.10.10 and you cannot upgrade, you can disable the 3GPP2 A11, Etheric, GPRS-LLC, IAPP, JXTA, and sFlow protocol dissectors by selecting Analyze->Enabled Protocols... and deselecting them from the list. However, it is strongly recommended that you upgrade to 0.10.10.