Linux Kernel Integer Overflow in sctp_getsockopt_local_addrs_old() Lets Local Users Deny Service
|
|
SecurityTracker Alert ID: 1020514
|
|
SecurityTracker URL: http://securitytracker.com/id?1020514
|
|
CVE Reference: CVE-2008-2826
(Links to External Site)
|
Date: Jul 17 2008
|
Impact: Denial of service via local system
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 2.6.25.9
|
Description: A vulnerability was reported in the Linux Kernel in the Stream Control Transmission Protocol code. A local user can cause denial of service conditions.
A local user can supply specially crafted addr_num data in an sctp_getaddrs_old data structure to trigger an integer overflow in
the sctp_getsockopt_local_addrs_old() function and consume excessive resources on the target system.
The vulnerability resides
in 'net/sctp/socket.c'.
|
Impact: A local user can cause excessive resource consumption on the target system.
|
Solution: The vendor has issued a fix (2.6.25.9).
The vendor's advisory is available at:
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.9
|
Vendor URL: www.kernel.org/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Caldera/SCO), Linux (Conectiva), Linux (Debian), Linux (EnGarde), Linux (Gentoo), Linux (HP Secure OS), Linux (Immunix), Linux (Mandriva/Mandrake), Linux (Progeny Debian), Linux (Red Hat Enterprise), Linux (Red Hat Fedora), Linux (Red Hat Linux), Linux (SGI), Linux (Slackware), Linux (Sun), Linux (SuSE), Linux (Trustix), Linux (Turbo Linux), Linux (Ubuntu), Linux (Xandros)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 16 Jul 2008 23:34:08 -0400
Subject: Linux Kernel
|
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.9
CVE-2008-2826
|
|
