National Cyber Awareness System

Vulnerability Summary for CVE-2008-4576

Overview

sctp in Linux kernel before 2.6.25.18 allows remote attackers to cause a denial of service (OOPS) via an INIT-ACK that states the peer does not support AUTH, which causes the sctp_process_init function to clean up active transports and triggers the OOPS when the T1-Init timer expires.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: FEDORA

Name: FEDORA-2008-8929

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00693.html

External Source: FEDORA

Name: FEDORA-2008-8980

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00689.html

External Source: XF

Name: linux-kernel-sctp-initack-dos(45773)

Hyperlink:http://xforce.iss.net/xforce/xfdb/45773

External Source: UBUNTU

Name: USN-679-1

Hyperlink:http://www.ubuntu.com/usn/usn-679-1

External Source: BID

Name: 31634

Hyperlink:http://www.securityfocus.com/bid/31634

External Source: REDHAT

Name: RHSA-2009:0009

Hyperlink:http://www.redhat.com/support/errata/RHSA-2009-0009.html

External Source: REDHAT

Name: RHSA-2008:1017

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-1017.html

External Source: CONFIRM

Name: http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.27-rc6-git6.log

Hyperlink:http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.27-rc6-git6.log

External Source: MLIST

Name: [linux-kernel] 20081006 [patch 58/71] sctp: Fix oops when INIT-ACK indicates that peer doesnt support AUTH

Hyperlink:http://www.gossamer-threads.com/lists/linux/kernel/981012?page=last

External Source: DEBIAN

Name: DSA-1687

Hyperlink:http://www.debian.org/security/2008/dsa-1687

External Source: DEBIAN

Name: DSA-1681

Hyperlink:http://www.debian.org/security/2008/dsa-1681

External Source: SECUNIA

Name: 33586

Hyperlink:http://secunia.com/advisories/33586

External Source: SECUNIA

Name: 33182

Hyperlink:http://secunia.com/advisories/33182

External Source: SECUNIA

Name: 33180

Hyperlink:http://secunia.com/advisories/33180

External Source: SECUNIA

Name: 32998

Hyperlink:http://secunia.com/advisories/32998

External Source: SECUNIA

Name: 32918

Hyperlink:http://secunia.com/advisories/32918

External Source: SECUNIA

Name: 32759

Hyperlink:http://secunia.com/advisories/32759

External Source: SECUNIA

Name: 32386

Type: Advisory

Hyperlink:http://secunia.com/advisories/32386

External Source: SECUNIA

Name: 32370

Hyperlink:http://secunia.com/advisories/32370

External Source: MLIST

Name: [oss-security] 20081008 CVE request: kernel: sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH

Hyperlink:http://permalink.gmane.org/gmane.comp.security.oss.general/1039

External Source: OVAL

Name: oval:org.mitre.oval:def:9822

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9822

External Source: SUSE

Name: SUSE-SR:2008:025

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html

External Source: SUSE

Name: SUSE-SA:2008:053

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00010.html

External Source: SUSE

Name: SUSE-SA:2008:052

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00008.html

External Source: CONFIRM

Name: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.18

Hyperlink:http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.18

References to Check Content

Identifier:oval:org.mitre.oval:def:9822

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9822