Technical Description

Mandriva has released updated packages to address a vulnerability identified in Ethereal. This flaw is due to a buffer overflow error in the "dissect_ospf_v3_address_prefix()" [packet-ospf.c] function of the Open Shortest Path First (OSPF) protocol dissector when converting data into a human readable string, which could be exploited by remote attackers to compromise or crash a vulnerable system. For additional information, see : VUPEN/ADV-2005-2830

Affected Products

Mandriva Linux 2006.0

Solution

Upgrade the affected packages :

Mandriva Linux 2006.0:
027fdd01892a957cbd51e12bfb67c5f8 2006.0/RPMS/ethereal-0.10.13-0.5.20060mdk.i586.rpm
73193fe2d3878cecab885d8b6cd6a08a 2006.0/RPMS/ethereal-tools-0.10.13-0.5.20060mdk.i586.rpm
2ec34afc4cdbd31bfa68640f13ff806e 2006.0/RPMS/libethereal0-0.10.13-0.5.20060mdk.i586.rpm
5254cd0a674ed501d25ec42ee4191cf1 2006.0/RPMS/tethereal-0.10.13-0.5.20060mdk.i586.rpm
a8c390894b8410e06b12d1f2049db2d6 2006.0/SRPMS/ethereal-0.10.13-0.5.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
09829fadefeb435e75aefa966b51cc56 x86_64/2006.0/RPMS/ethereal-0.10.13-0.5.20060mdk.x86_64.rpm
5c0e3a206220014841a540e149fe96e0 x86_64/2006.0/RPMS/ethereal-tools-0.10.13-0.5.20060mdk.x86_64.rpm
7ca64eb45c380c5eccec6d99e4ca9780 x86_64/2006.0/RPMS/lib64ethereal0-0.10.13-0.5.20060mdk.x86_64.rpm
8510de1e6d3f38ed08d6f863d56c0ee9 x86_64/2006.0/RPMS/tethereal-0.10.13-0.5.20060mdk.x86_64.rpm
a8c390894b8410e06b12d1f2049db2d6 x86_64/2006.0/SRPMS/ethereal-0.10.13-0.5.20060mdk.src.rpm

References

http://www.vupen.com/english/advisories/2005/2896
http://www.frsirt.com/english/reference/2523

ChangeLog

2005-12-15 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.