发布日期：2002-06-28
更新日期：2002-07-15

受影响系统：

Ethereal Group Ethereal 0.9.4
Ethereal Group Ethereal 0.9.3
Ethereal Group Ethereal 0.9.2
Ethereal Group Ethereal 0.9.1
Ethereal Group Ethereal 0.9.0
Ethereal Group Ethereal 0.8.18
    - Linux系统  
    - Microsoft Windows XP
    - Microsoft Windows NT 4.0
    - Microsoft Windows 2000 SP3
    - Unix系统

不受影响系统：

Ethereal Group Ethereal 0.9.5

描述：

---

CVE(CAN) ID: CVE-2002-0821

Ethereal是一款网络协议分析软件，可使用在多种Unix和Linux操作系统下。Ethereal包含BGP/WCP分析器用于分析BGP、WCP协议。

Ethereal包含的BGP、WCP分析器存在漏洞，远程攻击者可以利用这些漏洞进行缓冲区溢出攻击，可能以Ethereal进程的权限在系统上执行任意指令。

WCP (Wellfleet Compression Protocol)协议分析器在处理信息包时对帧的大小缺少正确的边界检查，攻击者可以构建超大帧并发送到Ethereal监听的网络中，Ethereal解码时会导致缓冲区溢出，造成拒绝服务攻击。

Ethereal BGP分析器用于对边界网关协议(BGP)进行解码，BGP分析器对信息包的大小缺少正确的边界检查，在某些条件下，攻击者可以发送畸形的超大的BGP数据导致Ethereal进程在解析的时候崩溃并产生core dump，造成拒绝服务攻击。

<*链接：http://www.ethereal.com/appnotes/enpa-sa-00005.html
*>

建议：

---

临时解决方法：

如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：

* 关闭有漏洞的BGP，WCP剖析器功能。

厂商补丁：

Ethereal Group
--------------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

Ethereal Group Ethereal 0.8.18:

Conectiva RPM ethereal-0.9.5-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/ethereal-0.9.5-1U60_1cl.i386.rpm

Conectiva RPM ethereal-0.9.5-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/ethereal-0.9.5-1U70_1cl.i386.rpm

Conectiva RPM ethereal-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-common-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-common-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-gtk-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-gtk-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-utils-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-utils-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM tethereal-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/tethereal-0.9.5-1U8_2cl.i386.rpm

Ethereal Group Upgrade ethereal-0.9.5.tar.gz
ftp://ftp.ethereal.com/pub/ethereal/ethereal-0.9.5.tar.gz

Ethereal Group Ethereal 0.9 .0:

Conectiva RPM ethereal-0.9.5-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/ethereal-0.9.5-1U60_1cl.i386.rpm

Conectiva RPM ethereal-0.9.5-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/ethereal-0.9.5-1U70_1cl.i386.rpm

Conectiva RPM ethereal-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-common-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-common-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-gtk-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-gtk-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-utils-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-utils-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM tethereal-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/tethereal-0.9.5-1U8_2cl.i386.rpm

Ethereal Group Upgrade ethereal-0.9.5.tar.gz
ftp://ftp.ethereal.com/pub/ethereal/ethereal-0.9.5.tar.gz

Ethereal Group Ethereal 0.9.1:

Conectiva RPM ethereal-0.9.5-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/ethereal-0.9.5-1U60_1cl.i386.rpm

Conectiva RPM ethereal-0.9.5-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/ethereal-0.9.5-1U70_1cl.i386.rpm

Conectiva RPM ethereal-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-common-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-common-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-gtk-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-gtk-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-utils-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-utils-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM tethereal-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/tethereal-0.9.5-1U8_2cl.i386.rpm

Ethereal Group Upgrade ethereal-0.9.5.tar.gz
ftp://ftp.ethereal.com/pub/ethereal/ethereal-0.9.5.tar.gz

Ethereal Group Ethereal 0.9.2:

Conectiva RPM ethereal-0.9.5-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/ethereal-0.9.5-1U60_1cl.i386.rpm

Conectiva RPM ethereal-0.9.5-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/ethereal-0.9.5-1U70_1cl.i386.rpm

Conectiva RPM ethereal-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-common-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-common-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-gtk-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-gtk-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-utils-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-utils-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM tethereal-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/tethereal-0.9.5-1U8_2cl.i386.rpm

Ethereal Group Upgrade ethereal-0.9.5.tar.gz
ftp://ftp.ethereal.com/pub/ethereal/ethereal-0.9.5.tar.gz

Ethereal Group Ethereal 0.9.3:

Conectiva RPM ethereal-0.9.5-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/ethereal-0.9.5-1U60_1cl.i386.rpm

Conectiva RPM ethereal-0.9.5-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/ethereal-0.9.5-1U70_1cl.i386.rpm

Conectiva RPM ethereal-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-common-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-common-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-gtk-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-gtk-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-utils-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-utils-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM tethereal-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/tethereal-0.9.5-1U8_2cl.i386.rpm

Ethereal Group Upgrade ethereal-0.9.5.tar.gz
ftp://ftp.ethereal.com/pub/ethereal/ethereal-0.9.5.tar.gz

Ethereal Group Ethereal 0.9.4:

Conectiva RPM ethereal-0.9.5-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/ethereal-0.9.5-1U60_1cl.i386.rpm

Conectiva RPM ethereal-0.9.5-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/ethereal-0.9.5-1U70_1cl.i386.rpm

Conectiva RPM ethereal-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-common-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-common-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-gtk-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-gtk-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM ethereal-utils-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/ethereal-utils-0.9.5-1U8_2cl.i386.rpm

Conectiva RPM tethereal-0.9.5-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/tethereal-0.9.5-1U8_2cl.i386.rpm

Ethereal Group Upgrade ethereal-0.9.5.tar.gz
ftp://ftp.ethereal.com/pub/ethereal/ethereal-0.9.5.tar.gz

浏览次数：3368
严重程度：0（网友投票）