CVE-2008-4618
6.1 Medium
AI Score
Confidence
Low
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
0.002 Low
EPSS
Percentile
58.4%
The Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.27 does not properly handle a protocol violation in which a parameter has an invalid length, which allows attackers to cause a denial of service (panic) via unspecified vectors, related to sctp_sf_violation_paramlen, sctp_sf_abort_violation, sctp_make_abort_violation, and incorrect data types in function calls.
References
git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=ba0166708ef4da7eeb61dd92bbba4d5a749d6561
lists.opensuse.org/opensuse-security-announce/2008-10/msg00010.html
secunia.com/advisories/32918
secunia.com/advisories/32998
secunia.com/advisories/33586
www.debian.org/security/2008/dsa-1681
www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27
www.openwall.com/lists/oss-security/2008/10/06/1
www.redhat.com/support/errata/RHSA-2009-0009.html
www.securityfocus.com/bid/31848
www.ubuntu.com/usn/usn-679-1
Social References
More
Related
6.1 Medium
AI Score
Confidence
Low
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
0.002 Low
EPSS
Percentile
58.4%