Linux Kernel UDP Fragmentation Offset (UFO) Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Linux Kernel UDP Fragmentation Offset UFO Privilege Escalation', 'Description' = %q This module attempts to gain root privileges on Linux systems...

Linux Kernel - UDP Fragmentation Offset 'UFO' Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Linux Kernel UDP Fragmentation Offset UFO Privilege Escalation', 'Description' = %q This module attempts to gain root privileges on Linux systems...

CVE-2018-0369

A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could allow an unauthenticated, remote attacker to trigger a reload of the npusim process, resulting in a denial of service DoS condition. There are four instances of the npusim proces...

Cisco StarOS IPv4 Fragmentation Denial of Service Vulnerability

A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could allow an unauthenticated, remote attacker to trigger a reload of the npusim process, resulting in a denial of service DoS condition. There are four instances of the npusim proces...

Sifang CSI-200EA Measurement and Control Device IP Protocol Segmentation Denial of Service Vulnerability

CSI-200EA measurement and control device is mainly used in substation automation system of 110kV and above voltage level. A denial of service vulnerability exists in the IP protocol fragmentation of the Sifang CSI-200EA measurement and control device. An attacker can cause the network function of...

CVE-2018-0252

CVE-2018-0252 affects Cisco Wireless LAN Controller software on the 3500/5500/8500 series. Root cause: corruption in an internal data structure during IPv4 fragment reassembly. Impact: unauthenticated remote attacker can trigger a device reload, causing DoS. Affected releases include all 8.4 vers...

Scientific Linux Security Update : glibc on SL7.x x86_64 (20180410)

Security Fixes : - glibc: realpath buffer underflow when getcwd returns relative path allows privilege escalation CVE-2018-1000001 - glibc: Buffer overflow in glob with GLOBTILDE CVE-2017-15670 - glibc: Buffer overflow during unescaping of user names with the operator CVE-2017-15804 - glibc: deni...

CVE-2018-0230: Uncontrolled Resource Consumption

A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense FTD Software for Cisco Firepower 2100 Series Security Appliances could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulting in a denial of servi...

Cisco Firepower 2100 Series Security Appliances IP Fragmentation Denial of Service Vulnerability

A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense FTD Software for Cisco Firepower 2100 Series Security Appliances could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulting in a denial of servi...

RHEL 7 : glibc (RHSA-2018:0805)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0805 advisory. - glibc: denial of service in getnetbyname function CVE-2014-9402 - glibc: DNS resolver NULL pointer dereference with crafted record type...

glibc: Fragmentation attacks possible when EDNS0 is enabled

The DNS stub resolver in the GNU C Library aka glibc or libc6 before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation...

tcpdump: Buffer over-read in print-frag6.c:frag6_print() in IPv6 fragmentation header parser

The IPv6 fragmentation header parser in tcpdump before 4.9.2 has a buffer over-read in print-frag6.c:frag6print...

Cisco IOS XE Software Zone-Based Firewall IP Fragmentation Denial of Service Vulnerability

A vulnerability in the Zone-Based Firewall code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a device to reload. The vulnerability is due to the way fragmented packets are handled in the firewall code. An attacker could exploit this vulnerability by sending...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4040)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4040 advisory. - gre: fix a possible skb leak Eric Dumazet Orabug: 26403972 CVE-2017-9074 - ipv6: Fix leak in ipv6gsosegment. David S. Miller Orabug: 26403972...

CentOS Update for kernel CESA-2018:0169 centos6

Check the version of kernel SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882840";...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20180125)

Security Fixes : - An integer overflow vulnerability in ip6find1stfragopt function was found. A local attacker that has privileges of CAPNETRAW to open raw socket can cause an infinite loop inside the ip6find1stfragopt function. CVE-2017-7542, Moderate - The IPv6 fragmentation implementation in t...

Oracle Linux 6 : kernel (ELSA-2018-0169) (deprecated)

From Red Hat Security Advisory 2018:0169 : An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

kernel: net: IPv6 fragmentation implementation of nexthdr field may be associated with an invalid option

The IPv6 fragmentation implementation in the Linux kernel does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service out-of-bounds read and BUG or possibly have unspecified other impact via crafted socket and send syste...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

RHEL 6 : kernel (RHSA-2018:0169)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0169 advisory. - kernel: Integer overflow in ip6find1stfragopt causes infinite loop CVE-2017-7542 - kernel: net: IPv6 fragmentation implementation of nexth...