APP: Ethereal UDP Netflow Dissector Buffer Overflow
This signature detects attempts to exploit a known vulnerability against the NetFlow dissector in Ethereal. Attackers can send maliciously crafted packets to the vulnerable dissectors to possibly execute arbitrary code on the host running Ethereal.
Extended Description
Ethereal 0.10.3 has been released to address multiple vulnerabilities. These issues include: - Thirteen stack-based buffer overruns in various protocol dissectors (NetFlow, IGAP, EIGRP, PGM, IrDA, BGP, ISUP, and TCAP). - A denial of service that is triggered by a zero length Presentation protocol selector. - Specially crafted RADIUS packets may cause a crash in Ethereal. - Corrupt color filter files may cause a crash in Ethereal. These issues may result in a denial of service or potentially be leveraged to execute arbitrary code in the instance of the buffer overruns.
Affected Products
Ethereal_group ethereal
Short Name
APP:ETHEREAL:NETFLOW-OF
Severity
Major
Recommended
False
Recommended Action
Drop
Category
APP
Keywords
Buffer CVE-2004-0176 Dissector Ethereal Netflow Overflow UDP bid:9952
Release Date
04/08/2004
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3336
Port
UDP/2055
False Positive
Unknown
Vendors
Sgi
Ethereal_group
Gentoo
CVSS Score
5.0