Multiple vulnerabilities have been reported in Ethereal, which potentially can be exploited to compromise a system running a vulnerable version of Ethereal.

The vulnerabilities are caused due to integer overflows and off-by-one errors in multiple dissectors. A malicious person can exploit this by sending a specially crafted packet to a network monitored by a system running Ethereal.

Successful exploitation will cause a buffer overflow and allow execution of arbitrary code with the privileges of the user running Ethereal.

The following dissectors are affected:

- AIM
- GIOP Gryphon
- OSPF
- PPTP
- Quake
- Quake2
- Quake3
- Rsync
- SMB
- SMPP
- TSP
- Mount
- PPP

Solution
Update to version 0.9.12:
Further details available in Customer Area

Provided and/or discovered by
Timo Sirainen

Original Advisory
http://www.ethereal.com/appnotes/enpa-sa-00009.html

Deep Links
Links available in Customer Area