Slashdot Mirror

← Back to Stories (view on slashdot.org)

Unhealthy Sniffing

Posted by timothy on from the price-of-slurping dept.

Simon Doring writes "Stefan Esser did it again. Yesterday he reported 13 remote root vulnerabilities in Ethereal. Time to teach all those sniffing kiddies an unhealthy lesson. The next LAN party will be a lot of fun."

5 of 49 comments (clear)

  1. Not the worst thing in the world by Old+Uncle+Bill · · Score: 4, Insightful

    Yeah, I don't like remote root exploits any more than the next guy, but are there a lot of people who run this 24/7? For the one hour a week I run this tool, I'm not AS concerned as if it was my OS with those vulnerabilities *cough*Windows*cough*.

    --
    Yes, I am an agent of Satan, but my duties are largely ceremonial.
  2. Privilege separation by Anonymous Coward · · Score: 1, Insightful

    There is no reason the Ethereal GUI or protocol analysis code needs to run as root. It should drop privileges as soon as it begins sniffing.

  3. This is very unfortunate by n1ywb · · Score: 3, Insightful

    Ethereal is a valuable network diagnostic tool. It has saved my ass a couple of times, and it has been helpful many times. I was the only person in my Networks class in college that was able to do my assignments from my room, everybody else had to go to the lab to use the commercial sniffer.

    On the other hand, 13 vulnerabilities isn't too terrible and hopefully they'll get them patched up straight away. I'm sure that your average commercial packet sniffer probably is probably just as bad or worse, and those bugs aren't getting fixed.

    --
    -73, de n1ywb
    www.n1ywb.com
    1. Re:This is very unfortunate by Phillup · · Score: 2, Insightful

      It would be unfortunate if it was a closed source application and the company had no desire to fix the problems.

      That isn't the case.

      This is just another step in making the product even better than it already is...

      --

      --Phillip

      Can you say BIRTH TAX
  4. Congrats to Ethereal team for quick resolution by Paladine97 · · Score: 4, Insightful

    You've got to hand it to the ethereal team for their quick fixes.

    The bottom of the advisory states that they were made aware on the 5th of March, and by the 23rd of March all the holes were fixed.