It's my understanding that the current design of Ethereal is such that
malicious packets embedded in a protocol that is being monitored can
possibly, or even likely lead to the execution of arbitrary code as
root. This could potentially give control of the machine to a remote
attacker.
It's also my understanding that with the current design it isn't even
possible to give any assurance that the program is in any way secure.
A further issue is that some of the protocol analysis code
(dissectors) are from 3rd parties and have not been audited for
security and might facilitate such an attack.
Perhaps an Ethereal developer or someone more knowledgeable in
Ethereal's internals would care to comment?
I would like to know if the Ethereal development team has a strategy
to improve security.
I would like to know if the Ethereal code and design has been audited
for security issues.
As a security professional it would be somewhat embarrassing to have
the PC used to monitor an attack being disabled or subverted by that
attacker.
This would be an excellent candidate for a thesis ... anyone?
Rgds,
-H-