|
Brought to you by:
Suppliers of:
|
|
|
| |
Ethereal is "a full featured open source network protocol analyzer".
Remote exploitation of a buffer overflow vulnerability in the Service Location Protocol (srvloc) dissectors within Ethereal allows attackers to crash the vulnerable process or execute arbitrary code. |
| |
Credit:
The information has been provided by iDEFENSE.
The original article can be found at:
http://www.idefense.com/application/poi/display?id=323
|
| |
Vulnerable Systems:
* Ethereal version 0.10.12 and earlier
Immune Systems:
* Ethereal version 0.10.13 (download here)
Vulnerable code:
--------------------------------- Begin Code ---------------------------------
./epan/dissectors/packet-srvloc.c:429
static guint8*
unicode_to_bytes(tvbuff_t *tvb, int offset, int length, gboolean
endianness)
{
const char *ascii_text = tvb_get_ptr(tvb, offset, length);
int i, j=0;
guint8 c_char, c_char1;
static guint8 byte_array[255];
if (endianness) {
...
}
}
else
{
for (i = 0; i < length; i++) {
c_char = ascii_text[i];
if (c_char != 0) {
byte_array[j] = c_char;
j++;
}
}
}
byte_array[j]=0;
return byte_array;
}
---------------------------------- End Code ----------------------------------
This function is called with a user-controlled length value on line 581 in the same file. This allows an attacker to cause an overflow of the byte_array array, as values greater than 255 may be specified. In lab analysis, it has been demonstrated that there are several interesting values beyond this array that make arbitrary code execution possible.
To cause Ethereal to dissect an arbitrary packet with the srvloc dissector, the source or destination port must be set to TCP port 427, and the destination port must not be a port with any registered dissector. As Ethereal does not keep state, a single spoofed TCP data packet can be used to exploit this vulnerability, regardless of whether there are any ports listening on either end.
Exploitation could result in remote root access, as Ethereal must have root privileges to open a raw socket.Ethereal is often used by network administrators to debug network problems and compromise of a network administrators machine can lead to further compromise of the network.
Workaround:
When using Ethereal, use the following filter to disable port 427, and therefore, automatic srvloc dissection:
not port 427
Vendor Status:
The vendor has addressed this issue in ethereal 0.10.13, available fordownload at:
http://www.ethereal.com/download.html
CVE Information:
CAN-2005-3184
Disclosure Timeline:
12.10.05 - Initial vendor notification
12.10.05 - Initial vendor response
20.10.05 - Coordinated public disclosure
|
|
|
|
|
