VulnerabilityModified

CVE-2003-0356

CRITICAL 9.8EPSS 9.57%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (9.57%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIOP Gryphon, (3) OSPF, (4) PPTP, (5) Quake, (6) Quake2, (7) Quake3, (8) Rsync, (9) SMB, (10) SMPP, and (11) TSP dissectors, which do not properly use the tvb_get_nstringz and tvb_get_nstringz0 functions.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 9.57% probability · 95th percentile
CISA KEV: Not listed
Weakness: CWE-193
Affected: ethereal/ethereal
Source: cve@mitre.org

References

http://www.debian.org/security/2003/dsa-313Broken Link, Patch, Vendor Advisory
http://www.ethereal.com/appnotes/enpa-sa-00009.htmlBroken Link, Patch, Vendor Advisory
http://www.kb.cert.org/vuls/id/641013Third Party Advisory, US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2003:067Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2003-077.htmlBroken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A69Broken Link
http://www.debian.org/security/2003/dsa-313Broken Link, Patch, Vendor Advisory
http://www.ethereal.com/appnotes/enpa-sa-00009.htmlBroken Link, Patch, Vendor Advisory
http://www.kb.cert.org/vuls/id/641013Third Party Advisory, US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2003:067Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2003-077.htmlBroken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A69Broken Link

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.