A code audit of the popular protocol analyser, Ethereal, has revealed several stack overflows which can be remotely triggered, according to a posting to the Full-Disclosure vulnerability mailing list.

Stefan Esser of e-matters Security, who discovered the vulnerabilities, described them as critical, and said the developers of the open source package were expected to release an updated version soon.

Ethereal runs on all common platforms, including Unix, Linux and Windows.

"With the exception of 3 (of the overflows), all discovered overflows allow arbitrary code execution by injecting carefully crafted packets to the sniffed wire or by convincing someone to load a malicious packet capture file into Ethereal," Esser said in his advisory.

Esser said the audit had begun this month but he had deemed it better to reveal all the overflows in a single advisory for the purpose of clarity.

He advised the disabling of the following dissectors under the Analyze->Enabled Protocols menu until an upgrade was ready: BGP, EIGRP, IGAP, IRDA, ISUP, NetFlow, PGM, TCAP, UCP.

smh.com.au
_________________________
Good artists copy, great artists
steal.

-Picasso