oss-sec mailing list archives
Re: CVE request: kernel: sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH
From: "Steven M. Christey" <coley () linus mitre org>
Date: Wed, 15 Oct 2008 14:46:39 -0400 (EDT)
This is one of those "I don't know what I'm typing" descriptions so any clarification would be welcome. - Steve ====================================================== Name: CVE-2008-4576 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4576 Reference: MLIST:[linux-kernel] 20081006 [patch 58/71] sctp: Fix oops when INIT-ACK indicates that peer doesnt support AUTH Reference: URL:http://www.gossamer-threads.com/lists/linux/kernel/981012?page=last Reference: CONFIRM:http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.18 sctp in Linux kernel before 2.6.25.18 allows remote attackers to cause a denial of service (OOPS) via an INIT-ACK that states the peer does not support AUTH, which causes the sctp_process_init function to clean up active transports and triggers the OOPS when the T1-Init timer expires.
Current thread:
- CVE request: kernel: sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH Eugene Teo (Oct 07)
- Re: CVE request: kernel: sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH Marcus Meissner (Oct 15)
- Re: CVE request: kernel: sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH Steven M. Christey (Oct 15)