CVE-2008-3276

Integer overflow in the dccpsetsockoptchange function in net/dccp/proto.c in the Datagram Congestion Control Protocol DCCP subsystem in the Linux kernel 2.6.17-rc1 through 2.6.26.2 allows remote attackers to cause a denial of service panic via a crafted integer value, related to Change L and Chan...

CVE-2008-3276

Integer overflow in the dccpsetsockoptchange function in net/dccp/proto.c in the Datagram Congestion Control Protocol DCCP subsystem in the Linux kernel 2.6.17-rc1 through 2.6.26.2 allows remote attackers to cause a denial of service panic via a crafted integer value, related to Change L and Chan...

CVE-2008-3276

The CVE-2008-3276 flaw is an integer overflow in the Linux kernel’s DCCP stack (dccp_setsockopt_change in net/dccp/proto.c) affecting kernel versions 2.6.17-rc1 through 2.6.26.2. It allows remote attackers to trigger a denial of service (panic) via crafted Change L/Change R options when dccpsf_va...

Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : linux, linux-source-2.6.15/20/22 vulnerabilities (USN-625-1)

Dirk Nehring discovered that the IPsec protocol stack did not correctly handle fragmented ESP packets. A remote attacker could exploit this to crash the system, leading to a denial of service. CVE-2007-6282 Johannes Bauer discovered that the 64bit kernel did not correctly handle hrtimer updates. ...

USN-625-1: Linux kernel vulnerabilities

Dirk Nehring discovered that the IPsec protocol stack did not correctly handle fragmented ESP packets. A remote attacker could exploit this to crash the system, leading to a denial of service. CVE-2007-6282 Johannes Bauer discovered that the 64bit kernel did not correctly handle hrtimer updates. ...

Fedora 9 : kernel-2.6.25.9-76.fc9 (2008-5893)

Update kernel from version 2.6.25.6 to 2.6.25.9: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.7 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.8 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.9 Security updates: CVE-2008-2750: The pppol2tprecvmsg functi...

kernel: dccp: sanity check feature length

Integer overflow in the dccpfeatchange function in net/dccp/feat.c in the Datagram Congestion Control Protocol DCCP subsystem in the Linux kernel 2.6.18, and 2.6.17 through 2.6.20, allows local users to gain privileges via an invalid feature length, which leads to a heap-based buffer overflow...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix various security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating...

Debian DSA-1592-1 : linux-2.6 - heap overflow

Two vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or arbitrary code execution. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-1673 Wei Wang from McAfee reported a potential heap overflow in the ASN.1...

Linux Kernel DCCP子系统缓冲区溢出漏洞

BUGTRAQ ID: 29603 CVE ID：CVE-2008-2358 CNCVE ID:CNCVE-20082358 Linux是一款开放源代码的操作系统。 Linux内核DCCP子系统存在缓冲区溢出，远程攻击者可以利用漏洞对系统进行拒绝服务攻击。 由于对长度的检查缺失，可触发缓冲区溢出，可能导致任意代码执行，目前没有详细漏洞细节提供。 Linux kernel 2.6.18 + Debian Linux 4.0 sparc + Debian Linux 4.0 s/390 + Debian Linux 4.0 powerpc + Debian Linux 4.0 mipsel ...

CVE-2008-2358

Integer overflow in the dccpfeatchange function in net/dccp/feat.c in the Datagram Congestion Control Protocol DCCP subsystem in the Linux kernel 2.6.18, and 2.6.17 through 2.6.20, allows local users to gain privileges via an invalid feature length, which leads to a heap-based buffer overflow...

CVE-2008-2358

Integer overflow in the dccpfeatchange function in net/dccp/feat.c in the Datagram Congestion Control Protocol DCCP subsystem in the Linux kernel 2.6.18, and 2.6.17 through 2.6.20, allows local users to gain privileges via an invalid feature length, which leads to a heap-based buffer overflow...

Integer overflow

Integer overflow in the dccpfeatchange function in net/dccp/feat.c in the Datagram Congestion Control Protocol DCCP subsystem in the Linux kernel 2.6.18, and 2.6.17 through 2.6.20, allows local users to gain privileges via an invalid feature length, which leads to a heap-based buffer overflow...

CVE-2008-2358

Integer overflow in the dccpfeatchange function in net/dccp/feat.c in the Datagram Congestion Control Protocol DCCP subsystem in the Linux kernel 2.6.18, and 2.6.17 through 2.6.20, allows local users to gain privileges via an invalid feature length, which leads to a heap-based buffer overflow...

CVE-2008-2358

The CVE-2008-2358 entry concerns the Linux kernel DCCP module: an integer overflow in dccp_feat_change within net/dccp/feat.c on kernels 2.6.17–2.6.20 and 2.6.18, enabling a local attacker to trigger a heap-based buffer overflow and gain privileges. Connected advisories reference this issue as pa...

Linux kernel multiple security vulnerabilities

Buffer overflow in CIFS and SNMP ASN.1 parsing code. Buffer overflow in DCCP...

DSA-1592-1 linux-2.6 - overflow conditions

Bulletin has no description...

Linux Kernel DCCP Proto.C缓冲区溢出漏洞

Linux是一款开放源代码的操作系统。 Linux处理DCCP套接字选项存在问题，远程攻击者可以利用漏洞进行缓冲区溢出攻击，可导致拒绝服务或任意代码执行攻击。 系统只检查是否有足够的空间存放int，但是len是由用户指定，可导致传递超大数据而导致溢出，精心构建提交数据可能以系统权限执行任意指令。 Linux kernel 2.6.20 .4 Linux kernel 2.6.20 Linux kernel 2.6.20 Linux kernel 2.6.19 1 Linux kernel 2.6.19 .2 Linux kernel 2.6.19 .1 Linux kernel 2.6....

linux-dccp.txt

Linux Kernel DCCP Memory Disclosure Vulnerability Synopsis: The Linux kernel is susceptible to a locally exploitable flaw which may allow local users to steal data from the kernel memory. Vulnerable Systems: Linux Kernel Versions: = 2.6.20 with DCCP support enabled. Kernel versions 2.6.20 lack...

Linux Kernel DCCP多个本地信息泄露漏洞

Linux是一款开放源代码的操作系统。 Linux针对DCCP支持存在多个问题，本地攻击者可以利用漏洞访问敏感信息。 问题存在于net/dccp/proto.c文件中的dodccpgetsockopt函数： ----------------------- static int dodccpgetsockoptstruct sock sk, int level, int optname, char user optval, int user optlen ... if getuserlen, optlen return -EFAULT; if len sizeofint return...