Vulnerability Note VU#695486

Overview

Ethereal fails to properly handle malformed color filter files, which could allow an attacker to cause a segmentation fault.

Description

Ethereal is a network traffic analysis package. It provides a feature that allows a user to customize the foreground and background colors of packet information that is displayed. There is a vulnerability in the way Ethereal handles color filter files. A local attacker could exploit this vulnerability by creating a malformed color filter.

Impact

A local attacker could cause a segmentation fault in Ethereal, leading to a denial of service.

Solution

Upgrade Upgrade to version 0.10.3 or later. Note: Ethereal is considered BETA software at this time.

Systems Affected (Learn More)

Vendor	Status	Date Notified	Date Updated
Ethereal	Affected	-	24 Mar 2004

If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group	Score	Vector
Base	N/A	N/A
Temporal	N/A	N/A
Environmental	N/A	N/A

References

• http://www.ethereal.com/appnotes/enpa-sa-00013.html
• http://secunia.com/advisories/11185/
• http://www.ethereal.com/docs/man-pages/ethereal.1.html

Credit

This vulnerability was reported by the developers of Ethereal.

This document was written by Damon Morda.

Other Information

• CVE IDs: Unknown
• Date Public: 22 Mar 2004
• Date First Published: 24 Mar 2004
• Date Last Updated: 05 Apr 2004
• Severity Metric: 1.34
• Document Revision: 11