Linux Kernel Buffer Overflow in DCCP Subsystem May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1020211
|
|
SecurityTracker URL: http://securitytracker.com/id?1020211
|
|
CVE Reference: CVE-2008-2358
(Links to External Site)
|
Date: Jun 9 2008
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 2.6.x
|
Description: A vulnerability was reported in Linux Kernel. A remote user can execute arbitrary code on the target system.
A remote user can send specially crafted data to trigger a buffer overflow in the DCCP subsystem and execute arbitrary code on the
target system. The code will run with the privileges of the target service.
The vulnerability resides in 'net/dccp/feat.c'.
Brandon
Edwards of McAfee Avert labs reported this vulnerability.
|
Impact: A remote user can execute arbitrary code on the target system.
|
Solution: Debian has issued a fix for Debian-based Linux systems.
[Editor's note: It appears that the fix is included in 2.6.25.5 and appears
to have been patched upstream in 2.6.25.x in January 2008. This fix may not have been backported to earlier versions by the various
Linux distribution vendors at that time.]
|
Vendor URL: www.kernel.org/ (Links to External Site)
|
Cause: Boundary error
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
