DSA-1592-1 linux-2.6 - overflow conditions

Bulletin has no description...

Linux Kernel DCCP Proto.C缓冲区溢出漏洞

Linux是一款开放源代码的操作系统。 Linux处理DCCP套接字选项存在问题，远程攻击者可以利用漏洞进行缓冲区溢出攻击，可导致拒绝服务或任意代码执行攻击。 系统只检查是否有足够的空间存放int，但是len是由用户指定，可导致传递超大数据而导致溢出，精心构建提交数据可能以系统权限执行任意指令。 Linux kernel 2.6.20 .4 Linux kernel 2.6.20 Linux kernel 2.6.20 Linux kernel 2.6.19 1 Linux kernel 2.6.19 .2 Linux kernel 2.6.19 .1 Linux kernel 2.6....

linux-dccp.txt

Linux Kernel DCCP Memory Disclosure Vulnerability Synopsis: The Linux kernel is susceptible to a locally exploitable flaw which may allow local users to steal data from the kernel memory. Vulnerable Systems: Linux Kernel Versions: = 2.6.20 with DCCP support enabled. Kernel versions 2.6.20 lack...

Linux Kernel DCCP多个本地信息泄露漏洞

Linux是一款开放源代码的操作系统。 Linux针对DCCP支持存在多个问题，本地攻击者可以利用漏洞访问敏感信息。 问题存在于net/dccp/proto.c文件中的dodccpgetsockopt函数： ----------------------- static int dodccpgetsockoptstruct sock sk, int level, int optname, char user optval, int user optlen ... if getuserlen, optlen return -EFAULT; if len sizeofint return...

Linux Kernel <= 2.6.20 with DCCP Support Memory Disclosure Exploit v2

No description provided by source. include netinet/in.h include stdio.h include sys/types.h include sys/socket.h include net/if.h include sys/mman.h include linux/net.h define BUFSIZE 0x10000000 int mainint argc, char argv void mem = mmap0, BUFSIZE, PROTREAD | PROTWRITE, MAPANONYMOUS | MAPPRIVATE...

linux-disclose-v2.txt

include include include include include include include define BUFSIZE 0x10000000 int mainint argc, char argv void mem = mmap0, BUFSIZE, PROTREAD | PROTWRITE, MAPANONYMOUS | MAPPRIVATE, 0, 0; if mem == void-1 printf"Alloc failed\n"; return -1; / SOCKDCCP, IPPROTODCCP / int s = socketPFINET, 6, 33...

CVE-2007-1734

The DCCP support in the dodccpgetsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later does not verify the upper bounds of the optlen value, which allows local users running on certain architectures to read kernel memory or cause a denial of service oops, a related issue to...

Out-of-bounds

The DCCP support in the dodccpgetsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later does not verify the upper bounds of the optlen value, which allows local users running on certain architectures to read kernel memory or cause a denial of service oops, a related issue to...

CVE-2007-1734

The DCCP support in the dodccpgetsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later does not verify the upper bounds of the optlen value, which allows local users running on certain architectures to read kernel memory or cause a denial of service oops, a related issue to...

CVE-2007-1734

CVE-2007-1734 is a Linux kernel vulnerability in the DCCP path: do_dccp_getsockopt does not verify the upper bounds of optlen in net/dccp/proto.c for 2.6.20 and later, enabling local attackers on some architectures to read kernel memory or cause a kernel oops. Public detail confirms affected prod...

CVE-2007-1730

Integer signedness error in the DCCP support in the dodccpgetsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later allows local users to read kernel memory or cause a denial of service oops via a negative optlen value...

Integer overflow

Integer signedness error in the DCCP support in the dodccpgetsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later allows local users to read kernel memory or cause a denial of service oops via a negative optlen value...

CVE-2007-1730

Integer signedness error in the DCCP support in the dodccpgetsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later allows local users to read kernel memory or cause a denial of service oops via a negative optlen value...

CVE-2007-1730

Integer signedness error in the DCCP support in the dodccpgetsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later allows local users to read kernel memory or cause a denial of service oops via a negative optlen value...

CVE-2007-1730

CVE-2007-1730 is a local kernel vulnerability due to an integer signedness error in the DCCP path (do_dccp_getsockopt) affecting Linux kernels 2.6.20 and later. The flaw allows a local user to read kernel memory or trigger a denial of service via a negative optlen. This is confirmed by Red Hat CV...

Linux Kernel 2.6.20 with DCCP Support - Memory Disclosure (2)

Linux Kernel 2.6.20 with DCCP Support - Memory Disclosure 2 include include include include include include include define BUFSIZE 0x10000000 int mainint argc, char argv void mem = mmap0, BUFSIZE, PROTREAD | PROTWRITE, MAPANONYMOUS | MAPPRIVATE, 0, 0; if mem == void-1 printf"Alloc failed\n"; retu...

Linux Kernel <= 2.6.20 with DCCP Support Memory Disclosure Exploit v2

Exploit for linux platform in category local exploits ===================================================================== Linux Kernel include include include include include include define BUFSIZE 0x10000000 int mainint argc, char argv void mem = mmap0, BUFSIZE, PROTREAD | PROTWRITE,...

Linux Kernel 2.6.20 with DCCP Support - Memory Disclosure (2)

include include include include include include include define BUFSIZE 0x10000000 int mainint argc, char argv void mem = mmap0, BUFSIZE, PROTREAD | PROTWRITE, MAPANONYMOUS | MAPPRIVATE, 0, 0; if mem == void-1 printf"Alloc failed\n"; return -1; / SOCKDCCP, IPPROTODCCP / int s = socketPFINET, 6, 33...

Linux Kernel <= 2.6.20 with DCCP Support Memory Disclosure Exploit

Exploit for linux platform in category local exploits ================================================================== Linux Kernel = 2.6.20 with DCCP support enabled. Kernel versions 2.6.20 lack DCCPSOCKOPTSENDCSCOV/DCCPSOCKOPTRECVCSCOV optnames for getsockopt call with SOLDCCP level, which ar...

Linux Kernel 2.6.20 with DCCP Support - Memory Disclosure (1)

/ Linux Kernel DCCP Memory Disclosure Vulnerability Synopsis: The Linux kernel is susceptible to a locally exploitable flaw which may allow local users to steal data from the kernel memory. Vulnerable Systems: Linux Kernel Versions: = 2.6.20 with DCCP support enabled. Kernel versions 2.6.20 lack...