Vulnerability Description
Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIOP Gryphon, (3) OSPF, (4) PPTP, (5) Quake, (6) Quake2, (7) Quake3, (8) Rsync, (9) SMB, (10) SMPP, and (11) TSP dissectors, which do not properly use the tvb_get_nstringz and tvb_get_nstringz0 functions.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ethereal | Ethereal | < 0.9.12 |
Related Weaknesses (CWE)
References
- http://www.debian.org/security/2003/dsa-313Broken LinkPatchVendor Advisory
- http://www.ethereal.com/appnotes/enpa-sa-00009.htmlBroken LinkPatchVendor Advisory
- http://www.kb.cert.org/vuls/id/641013Third Party AdvisoryUS Government Resource
- http://www.mandriva.com/security/advisories?name=MDKSA-2003:067Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2003-077.htmlBroken Link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Broken Link
- http://www.debian.org/security/2003/dsa-313Broken LinkPatchVendor Advisory
- http://www.ethereal.com/appnotes/enpa-sa-00009.htmlBroken LinkPatchVendor Advisory
- http://www.kb.cert.org/vuls/id/641013Third Party AdvisoryUS Government Resource
- http://www.mandriva.com/security/advisories?name=MDKSA-2003:067Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2003-077.htmlBroken Link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Broken Link
FAQ
What is CVE-2003-0356?
CVE-2003-0356 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIOP Gryphon, (3) OSPF, ...
How severe is CVE-2003-0356?
CVE-2003-0356 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2003-0356?
Check the references section above for vendor advisories and patch information. Affected products include: Ethereal Ethereal.