Can an attacker eavesdrop on Ethernet data, if they can connect to it? Yes. An attacker who is physically connected to your Ethernet network can probably eavesdrop upon all of the packets sent upon that local-area network.
You might think that switched Ethernet would prevent that, but in fact on many/most Ethernet switches, it does not. An attacker can use MAC flooding to force the switch into a degraded mode where it sends a copy of all packets to the attacker, thus allowing the attacker to eavesdrop on all traffic sent on that local-area Ethernet network. Similarly, ARP spoofing may allow an attacker to cause some packets to be routed to him. Not all routers are known to be vulnerable, but these attacks can be pretty subtle, and I'm not confident that the community has fully explored the space of possible attacks in this vein. Therefore, I recommend that you conservatively assume that this attack is possible.
In other words, I recommend you assume that anyone who can plug into your Ethernet network can probably eavesdrop on all packets sent on that local-area network.
These attacks do not require a special network interface card. Any Ethernet card suffices. The attacker just needs to run a packet sniffer program, which sets the Ethernet card to promiscuous mode and asks it to show all Ethernet packets that are visible to that Ethernet card.
How can you defend against this? The strongest defense is to use strong cryptography to encrypt all communications, and make sure that only trusted/authorized individuals receive the crypto keys. Using IPSec to encrypt all traffic would be sufficient. So would any other VPN or link-layer encryption software. The main downside is that these solutions can require considerable configuration and thus be clumsy to use.
Another defense is to do your darndest to ensure that untrusted individuals cannot plug into your Ethernet network. For instance, if you want to expose Ethernet ports in public spaces, you might create a separate guest network -- firewalled off from your internal corporate network -- and ensure that all Ethernet jacks in public spaces are connected to the guest network. You should complement this with physical security, to ensure that unauthorized individuals do not gain access to your workspace, to network closets, to server rooms, etc.
You can also firewall off internal networks from each other, following the "least privilege" principle. For instance, if payroll has particularly sensitive information on their systems and local Ethernet networks, then you might arrange that their local-area Ethernet network is limited to their building or their offices -- so that other employees who aren't part of the payroll department don't have a connection to that local-area Ethernet network.
A third defense is to encourage users to use encryption for all sensitive communications. This provides a fallback in case an attacker does gain access to your internal Ethernet network. For instance, you might ensure that sensitive internal web services are set up to use SSL sitewide, and other sensitive internal services are configured to use encryption. You might prohibit cleartext passwords on your internal network (e.g., require SSH and SFTP instead of telnet and FTP). You might encourage users to use HTTPS Everywhere to protect their web traffic, where supported by web servers.
A fourth defense is to enable features on your Ethernet switches to defend against such attacks. You can use client authentication (e.g., 802.1X) to ensure that only authorized clients can connect to the Ethernet network. (MAC address filtering is a poor man's version of this which provides only a low level of security.) You can also enable "port security" and similar security features that are specifically designed to prevent MAC flooding and ARP spoofing attacks.