ethereal security update

Updated Ethereal packages that fix various security vulnerabilities are now
available.

Ethereal is a program for monitoring network traffic.

The SNMP dissector in Ethereal releases 0.8.15 through 0.10.4 contained a
memory read flaw. On a system where Ethereal is running, a remote
attacker could send malicious packets that could cause Ethereal to crash or
possibly execute arbitrary code. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2004-0635 to this issue.

The SMB dissector in Ethereal releases 0.9.15 through 0.10.4 contained a
null pointer flaw. On a system where Ethereal is running, a remote
attacker could send malicious packets that could cause Ethereal to crash.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0634 to this issue.

The iSNS dissector in Ethereal releases 0.10.3 through 0.10.4 contained an
integer overflow flaw. On a system where Ethereal is running, a remote
attacker could send malicious packets that could cause Ethereal to crash or
possibly execute arbitrary code. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2004-0633 to this issue.

Users of Ethereal should upgrade to these updated packages, which contain
a version that is not vulnerable to these issues.

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

127381 - CAN-2004-0633/34/35 Multiple problems in Ethereal 0.10.4

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0633
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0634
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0635
http://www.ethereal.com/appnotes/enpa-sa-00015.html