Risk: Medium
Multiple security vulnerabilities have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets that could cause Ethereal to crash or execute arbitrary code. In order for an attacker to exploit these vulnerabilities, an authenticated local system user would first have to manually start the Ethereal application.
Network administrators on Linux, Unix and Windows systems often use Ethereal to inspect network packet data. Buffer overflow exploits found recently in the OSPF, IRC, SLP, STCP and other protocol decoders have been found. Users are recommended to upgrade to the latest release of Ethereal (0.10.13 at the time of writing).
As good practice, it is recommended that packets be captured separately to being viewed. Packet capture usually requires 'root' or 'administrator' privileges, but is considered safe without protocol decoding. The tcpdump utility is able to save packet dumps to disk, which can then be read by Ethereal, running as a low privilege user. This reduces the risk of damage or compromise to systems from future exploits.