Ethereal Multiple Unspecified Denial of Service and Potential Code Execution Vulnerabilities

Ethereal 0.10.8 has been released to address multiple vulnerabilities. These issues are reported to cause denial-of-service conditions in the application; some issues may allow arbitrary code execution.

The following specific issues were specified:

- A denial-of-service vulnerability presents itself in the DICOM dissector.
- Another denial-of-service vulnerability occurs when handling a malformed RTP timestamp.
- Another denial of service arises when Ethereal processes a specially crafted SMB packet.
- The HTTP dissector may allow a remote attacker to access memory that was previously freed.

This BID will be updated as more information becomes available.


Privacy Statement
Copyright 2010, SecurityFocus