ethereal security update
Security Advisory: Moderate
Updated Ethereal packages that fix various security vulnerabilities are now
available.
Ethereal is a program for monitoring network traffic.
The SNMP dissector in Ethereal releases 0.8.15 through 0.10.4 contained a
memory read flaw. On a system where Ethereal is running, a remote
attacker could send malicious packets that could cause Ethereal to crash or
possibly execute arbitrary code. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2004-0635 to this issue.
The SMB dissector in Ethereal releases 0.9.15 through 0.10.4 contained a
null pointer flaw. On a system where Ethereal is running, a remote
attacker could send malicious packets that could cause Ethereal to crash.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0634 to this issue.
The iSNS dissector in Ethereal releases 0.10.3 through 0.10.4 contained an
integer overflow flaw. On a system where Ethereal is running, a remote
attacker could send malicious packets that could cause Ethereal to crash or
possibly execute arbitrary code. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2004-0633 to this issue.
Users of Ethereal should upgrade to these updated packages, which contain
a version that is not vulnerable to these issues.
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
Vulmon