CVE-2000-0333: Medium severity Ethereal Group Ethereal vulnerability

Published May 31, 1999

Updated

tcpdump, Ethereal, and other sniffer packages allow remote attackers to cause a denial of service via malformed DNS packets in which a jump offset refers to itself, which causes tcpdump to enter an infinite loop while decompressing the packet.

Affected Software

5 affected components

Ethereal Group Ethereal=0.8.5

Ethereal Group Ethereal=0.8.6

Lbl Tcpdump=3.4

Ethereal Group Ethereal=0.8.4

Lbl Tcpdump=3.5a

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove tcpdump from your environment.
Uninstall tcpdump from systems where packet capture is not required to eliminate exposure to the vulnerable DNS decompression code path.
Remove
Remove Ethereal from your environment.
Uninstall Ethereal from systems where packet capture is not required to eliminate exposure to the vulnerable DNS decompression code path.
Configuration
Configure the packet capture tool to exclude DNS traffic (for example, set a BPF capture filter such as 'not port 53' or equivalent) so the tool will not attempt to decompress DNS packets.
tcpdump / Ethereal capture_filter = exclude DNS (port 53)
Compensating control
At the network perimeter or host firewall, block or filter DNS traffic (UDP/TCP port 53) to machines running packet-capture tools or restrict DNS traffic to trusted sources only, preventing delivery of malformed DNS packets to the sniffer.
Operational
Stop or terminate any active tcpdump/Ethereal packet-capture sessions and avoid running these sniffers until a vendor-supplied patch is available.

Event History

May 31, 1999

CVE Published

04:00 AM

Data Sourced

via NVD·04:00 AM

RemedyDescriptionSeverityAffected Software

May 18, 2000

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-0333?

CVE-2000-0333 is considered a moderate severity vulnerability due to its potential to cause a denial of service.

How do I fix CVE-2000-0333?

To fix CVE-2000-0333, upgrade to the latest versions of tcpdump or Ethereal that contain patches for this vulnerability.

Which software is affected by CVE-2000-0333?

CVE-2000-0333 affects tcpdump versions 3.4 and 3.5a, as well as Ethereal versions 0.8.4, 0.8.5, and 0.8.6.

What type of attack is enabled by CVE-2000-0333?

CVE-2000-0333 enables a denial of service attack through malformed DNS packets that can cause affected software to enter an infinite loop.

Can CVE-2000-0333 be exploited remotely?

Yes, CVE-2000-0333 can be exploited remotely by attackers who send crafted DNS packets to the vulnerable software.