Description
The add_conversation function in conversations.c in EtherApe before 0.9.12 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RPC packet, related to the get_rpc function in decode_proto.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | etherape | 0.9.12-1 | — |
| Debian 13 | etherape | 0.9.12-1 | — |
| Debian 12 | etherape | 0.9.12-1 | — |
References
- [oss-security] 20110922 Re: CVE Request? etherape remote crash (denial of service) mailing-list
- 45989 third-party-advisory
- [oss-security] 20110919 CVE Request? etherape remote crash (denial of service) mailing-list
- http://sourceforge.net/tracker/?func=detail&aid=3309061&group_id=2712&atid=102712
- http://etherape.sourceforge.net/NEWS.html