Description
Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIOP Gryphon, (3) OSPF, (4) PPTP, (5) Quake, (6) Quake2, (7) Quake3, (8) Rsync, (9) SMB, (10) SMPP, and (11) TSP dissectors, which do not properly use the tvb_get_nstringz and tvb_get_nstringz0 functions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | ethereal | 0.9.4-1woody4 | DSA-313 |
Advisories 1
- DSA-313 ethereal - buffer overflows, integer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- VU#641013 third-party-advisory
- RHSA-2003:077 vendor-advisory
- oval:org.mitre.oval:def:69 vdb-entry signature
- http://www.ethereal.com/appnotes/enpa-sa-00009.html
- DSA-313 vendor-advisory
- MDKSA-2003:067 vendor-advisory