ID CVE-2005-2367
Summary Format string vulnerability in the proto_item_set_text function in Ethereal 0.9.4 through 0.10.11, as used in multiple dissectors, allows remote attackers to write to arbitrary memory locations and gain privileges via a crafted AFP packet.
References
Vulnerable Configurations
  • cpe:2.3:a:ethereal_group:ethereal:0.9.4
    cpe:2.3:a:ethereal_group:ethereal:0.9.4
  • cpe:2.3:a:ethereal_group:ethereal:0.9.5
    cpe:2.3:a:ethereal_group:ethereal:0.9.5
  • cpe:2.3:a:ethereal_group:ethereal:0.9.6
    cpe:2.3:a:ethereal_group:ethereal:0.9.6
  • cpe:2.3:a:ethereal_group:ethereal:0.9.7
    cpe:2.3:a:ethereal_group:ethereal:0.9.7
  • cpe:2.3:a:ethereal_group:ethereal:0.9.8
    cpe:2.3:a:ethereal_group:ethereal:0.9.8
  • cpe:2.3:a:ethereal_group:ethereal:0.9.9
    cpe:2.3:a:ethereal_group:ethereal:0.9.9
  • cpe:2.3:a:ethereal_group:ethereal:0.9.10
    cpe:2.3:a:ethereal_group:ethereal:0.9.10
  • cpe:2.3:a:ethereal_group:ethereal:0.9.11
    cpe:2.3:a:ethereal_group:ethereal:0.9.11
  • cpe:2.3:a:ethereal_group:ethereal:0.9.12
    cpe:2.3:a:ethereal_group:ethereal:0.9.12
  • cpe:2.3:a:ethereal_group:ethereal:0.9.13
    cpe:2.3:a:ethereal_group:ethereal:0.9.13
  • cpe:2.3:a:ethereal_group:ethereal:0.9.14
    cpe:2.3:a:ethereal_group:ethereal:0.9.14
  • cpe:2.3:a:ethereal_group:ethereal:0.9.15
    cpe:2.3:a:ethereal_group:ethereal:0.9.15
  • cpe:2.3:a:ethereal_group:ethereal:0.9.16
    cpe:2.3:a:ethereal_group:ethereal:0.9.16
  • cpe:2.3:a:ethereal_group:ethereal:0.10.0
    cpe:2.3:a:ethereal_group:ethereal:0.10.0
  • cpe:2.3:a:ethereal_group:ethereal:0.10.1
    cpe:2.3:a:ethereal_group:ethereal:0.10.1
  • cpe:2.3:a:ethereal_group:ethereal:0.10.2
    cpe:2.3:a:ethereal_group:ethereal:0.10.2
  • cpe:2.3:a:ethereal_group:ethereal:0.10.3
    cpe:2.3:a:ethereal_group:ethereal:0.10.3
  • cpe:2.3:a:ethereal_group:ethereal:0.10.4
    cpe:2.3:a:ethereal_group:ethereal:0.10.4
  • cpe:2.3:a:ethereal_group:ethereal:0.10.5
    cpe:2.3:a:ethereal_group:ethereal:0.10.5
  • cpe:2.3:a:ethereal_group:ethereal:0.10.6
    cpe:2.3:a:ethereal_group:ethereal:0.10.6
  • cpe:2.3:a:ethereal_group:ethereal:0.10.7
    cpe:2.3:a:ethereal_group:ethereal:0.10.7
  • cpe:2.3:a:ethereal_group:ethereal:0.10.8
    cpe:2.3:a:ethereal_group:ethereal:0.10.8
  • cpe:2.3:a:ethereal_group:ethereal:0.10.9
    cpe:2.3:a:ethereal_group:ethereal:0.10.9
  • cpe:2.3:a:ethereal_group:ethereal:0.10.10
    cpe:2.3:a:ethereal_group:ethereal:0.10.10
  • cpe:2.3:a:ethereal_group:ethereal:0.10.11
    cpe:2.3:a:ethereal_group:ethereal:0.10.11
CVSS
Base: 7.5 (as of 10-08-2005 - 09:35)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
exploit-db via4
description Ethereal 10.x AFP Protocol Dissector Remote Format String Exploit. CVE-2005-2367. Remote exploit for linux platform
id EDB-ID:1139
last seen 2016-01-31
modified 2005-08-06
published 2005-08-06
reporter vade79
source https://www.exploit-db.com/download/1139/
title Ethereal 10.x AFP Protocol Dissector Remote Format String Exploit
nessus via4
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2005-131.NASL
    description A number of vulnerabilities were discovered in versions of Ethereal prior to version 0.10.12, including : The SMB dissector could overflow a buffer or exhaust memory (CVE-2005-2365). iDefense discovered that several dissectors are vulnerable to format string overflows (CVE-2005-2367). A number of other portential crash issues in various dissectors have also been corrected. This update provides Ethereal 0.10.12 which is not vulnerable to these issues.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 19891
    published 2005-10-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=19891
    title Mandrake Linux Security Advisory : ethereal (MDKSA-2005:131)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2005-687.NASL
    description Updated Ethereal packages that fix various security vulnerabilities are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The ethereal package is a program for monitoring network traffic. A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws and cause Ethereal to crash or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-2360, CVE-2005-2361, CVE-2005-2362, CVE-2005-2363, CVE-2005-2364, CVE-2005-2365, CVE-2005-2366, and CVE-2005-2367 to these issues. Users of ethereal should upgrade to these updated packages, which contain version 0.10.12 which is not vulnerable to these issues. Note: To reduce the risk of future vulnerabilities in Ethereal, the ethereal and tethereal programs in this update have been compiled as Position Independent Executables (PIE) for Red Hat Enterprise Linux 3 and 4. In addition FORTIFY_SOURCE has been enabled for Red Hat Enterprise Linux 4 packages to provide compile time and runtime buffer checks.
    last seen 2019-02-21
    modified 2018-11-27
    plugin id 19424
    published 2005-08-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=19424
    title RHEL 2.1 / 3 / 4 : ethereal (RHSA-2005:687)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-853.NASL
    description Several security problems have been discovered in ethereal, a commonly used network traffic analyser. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-2360 Memory allocation errors in the LDAP dissector can cause a denial of service. - CAN-2005-2361 Various errors in the AgentX, PER, DOCSIS, RADIUS, Telnet, IS-IS, HTTP, DCERPC, DHCP and SCTP dissectors can cause a denial of service. - CAN-2005-2363 Various errors in the SMPP, 802.3, H1 and DHCP dissectors can cause a denial of service. - CAN-2005-2364 NULL pointer dereferences in the WBXML and GIOP dissectors can cause a denial of service. - CAN-2005-2365 A buffer overflow and NULL pointer dereferences in the SMB dissector can cause a denial of service. - CAN-2005-2366 Wrong address calculation in the BER dissector can cause an infinite loop or abortion. - CAN-2005-2367 Format string vulnerabilities in several dissectors allow remote attackers to write to arbitrary memory locations and thus gain privileges.
    last seen 2019-02-21
    modified 2018-08-09
    plugin id 19961
    published 2005-10-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=19961
    title Debian DSA-853-1 : ethereal - several vulnerabilities
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200507-27.NASL
    description The remote host is affected by the vulnerability described in GLSA-200507-27 (Ethereal: Multiple vulnerabilities) There are numerous vulnerabilities in versions of Ethereal prior to 0.10.12, including: The SMB dissector could overflow a buffer or exhaust memory (CAN-2005-2365). iDEFENSE discovered that several dissectors are vulnerable to format string overflows (CAN-2005-2367). Additionally multiple potential crashes in many dissectors have been fixed, see References for further details. Impact : An attacker might be able to use these vulnerabilities to crash Ethereal or execute arbitrary code with the permissions of the user running Ethereal, which could be the root user. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 19329
    published 2005-07-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=19329
    title GLSA-200507-27 : Ethereal: Multiple vulnerabilities
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2005-687.NASL
    description Updated Ethereal packages that fix various security vulnerabilities are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The ethereal package is a program for monitoring network traffic. A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws and cause Ethereal to crash or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-2360, CVE-2005-2361, CVE-2005-2362, CVE-2005-2363, CVE-2005-2364, CVE-2005-2365, CVE-2005-2366, and CVE-2005-2367 to these issues. Users of ethereal should upgrade to these updated packages, which contain version 0.10.12 which is not vulnerable to these issues. Note: To reduce the risk of future vulnerabilities in Ethereal, the ethereal and tethereal programs in this update have been compiled as Position Independent Executables (PIE) for Red Hat Enterprise Linux 3 and 4. In addition FORTIFY_SOURCE has been enabled for Red Hat Enterprise Linux 4 packages to provide compile time and runtime buffer checks.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 21850
    published 2006-07-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21850
    title CentOS 3 / 4 : ethereal (CESA-2005:687)
oval via4
accepted 2013-04-29T04:08:30.972-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description Format string vulnerability in the proto_item_set_text function in Ethereal 0.9.4 through 0.10.11, as used in multiple dissectors, allows remote attackers to write to arbitrary memory locations and gain privileges via a crafted AFP packet.
family unix
id oval:org.mitre.oval:def:10765
status accepted
submitted 2010-07-09T03:56:16-04:00
title Format string vulnerability in the proto_item_set_text function in Ethereal 0.9.4 through 0.10.11, as used in multiple dissectors, allows remote attackers to write to arbitrary memory locations and gain privileges via a crafted AFP packet.
version 23
redhat via4
advisories
rhsa
id RHSA-2005:687
refmap via4
bid 14399
confirm http://www.ethereal.com/appnotes/enpa-sa-00020.html
debian DSA-853
fedora FLSA-2006:152922
gentoo GLSA-200507-27
idefense 20050805 Multiple Vendor Ethereal AFP Protocol Dissector Format String Vulnerability
mandrake MDKSA-2005:131
secunia
  • 16225
  • 17102
suse
  • SUSE-SR:2005:018
  • SUSE-SR:2005:019
Last major update 21-08-2010 - 00:31
Published 10-08-2005 - 00:00
Last modified 10-10-2017 - 21:30
Back to Top