FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2004-0365

This CVE name corresponds to:

Entered	Topic
2004-03-26	multiple vulnerabilities in ethereal

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2004-0365 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2004-0365
Phase	Assigned(20040322)

Description

The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference.

References

Source	Reference
MLIST	[ethereal-dev] 20040318 ethereal radius dissector vulnerability
CONFIRM	http://www.ethereal.com/appnotes/enpa-sa-00013.html
BUGTRAQ	20040329 LNSA-#2004-0007: Multiple security problems in Ethereal
GENTOO	GLSA-200403-07
CONECTIVA	CLA-2004:835
MANDRAKE	MDKSA-2004:024
REDHAT	RHSA-2004:136
REDHAT	RHSA-2004:137
BUGTRAQ	20040416 [OpenPKG-SA-2004.015] OpenPKG Security Advisory (ethereal)
CERT-VN	VU#124454
OVAL	oval:org.mitre.oval:def:879
OVAL	oval:org.mitre.oval:def:891
SECUNIA	11185
XF	ethereal-radius-dos(15571)