Solaris IPv6 Bug in Processing IPSec Packets Lets Remote Users Execute Arbitrary Code

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker Alert ID: 1018252

SecurityTracker URL: http://securitytracker.com/id/1018252

CVE Reference: CVE-2007-3248 (Links to External Site)

Updated: May 11 2008

Original Entry Date: Jun 15 2007

Impact: Denial of service via local system, Denial of service via network

Fix Available: Yes Vendor Confirmed: Yes

Description: A vulnerability was reported in Sun Solaris. A remote user can cause denial of service conditions.

On a system that is configured to use IPv6 but not IPSec, a remote user or local user can trigger a kernel panic.

Solaris 8 and Solaris 9 are not affected.

Impact: A remote or local user can cause a kernel panic.

Solution: The vendor has issued the following fixes.

SPARC Platform:

* Solaris 10 with patch 125100-09 or later

x86 Platform:

* Solaris 10 with patch 125101-09 or later

The Sun advisory is available at:

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102919-1

Vendor URL: sunsolve.sun.com/search/document.do?assetkey=1-26-102919-1 (Links to External Site)

Cause: Exception handling error

Underlying OS: UNIX (Solaris - SunOS)

Message History: None.

Date: Thu, 14 Jun 2007 23:58:21 -0400
Subject: Security Vulnerability in IPv6 Implementation (ip6(7p)) Related to the Handling of IPsec Packets may Lead to a System Panic, Resulting in a Denial of Service (DoS)


http://sunsolve.sun.com/search/document.do?assetkey=1-26-102919-1