Test ID:	1.3.6.1.4.1.25623.1.0.146546
Category:	General
Title:	ICMP 'Etherleak' Information Disclosure
Summary:	The remote host is prone to an information disclosure; vulnerability over ICMP dubbed 'Etherleak'.
Description:	Summary: The remote host is prone to an information disclosure vulnerability over ICMP dubbed 'Etherleak'. Vulnerability Insight: Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak. Vulnerability Impact: An unauthenticated attacker might gather sensitive information. Affected Software/OS: The following products / devices are known to be affected (Some have vendor specific CVEs): - Original CVE-2003-0001: * Multiple unnamed ethernet Network Interface Card (NIC) device drivers * The Linux Kernel on at least Debian * FreeBSD and NetBSD * Windows 2000 * Cisco Adaptive Security Appliance (ASA, CSCua88376) * HP-UX network device drivers (HPSBUX0305-261) - CVE-2013-4690, JSA10579: Juniper Networks Junos OS on SRX1400, SRX3400 and SRX3600 devices - CVE-2017-2304, JSA10773: Juniper Networks Junos OS on QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 Series devices - CVE-2018-0014, JSA10841: Juniper Networks ScreenOS devices - CVE-2021-3031, PAN-124681: Palo Alto PAN-OS on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls - CVE-2022-22216, JSA69720: Juniper Networks Junos OS on PTX and QFX10k Series devices Other products / devices might be affected as well. Solution: Contact the vendor of the network device driver for a solution. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0001 @stake Security Advisory: A010603-1 http://www.atstake.com/research/advisories/2003/a010603-1.txt Bugtraq: 20030106 Etherleak: Ethernet frame padding information leakage (A010603-1) (Google Search) http://www.securityfocus.com/archive/1/305335/30/26420/threaded Bugtraq: 20030110 More information regarding Etherleak (Google Search) http://marc.info/?l=bugtraq&m=104222046632243&w=2 Bugtraq: 20030117 Re: More information regarding Etherleak (Google Search) http://www.securityfocus.com/archive/1/307564/30/26270/threaded CERT/CC vulnerability note: VU#412115 http://www.kb.cert.org/vuls/id/412115 http://www.atstake.com/research/advisories/2003/atstake_etherleak_report.pdf http://www.osvdb.org/9962 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2665 http://www.redhat.com/support/errata/RHSA-2003-025.html http://www.redhat.com/support/errata/RHSA-2003-088.html http://www.securitytracker.com/id/1031583 http://www.securitytracker.com/id/1040185 http://secunia.com/advisories/7996 http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0016.html Common Vulnerability Exposure (CVE) ID: CVE-2013-4690 BugTraq ID: 61123 http://www.securityfocus.com/bid/61123 http://osvdb.org/95112 XForce ISS Database: junos-cve20134690-info-disc(85627) https://exchange.xforce.ibmcloud.com/vulnerabilities/85627 Common Vulnerability Exposure (CVE) ID: CVE-2017-2304 BugTraq ID: 95403 http://www.securityfocus.com/bid/95403 http://www.securitytracker.com/id/1037593 Common Vulnerability Exposure (CVE) ID: CVE-2018-0014 Common Vulnerability Exposure (CVE) ID: CVE-2021-3031 https://security.paloaltonetworks.com/CVE-2021-3031 Common Vulnerability Exposure (CVE) ID: CVE-2022-22216 https://kb.juniper.net/JSA69720
Copyright	Copyright (C) 2021 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.