CVE-2011-4007

Cisco IOS 15.0 and 15.1 and IOS XE 3.x do not properly handle the "set mpls experimental imposition" command, which allows remote attackers to cause a denial of service device crash via network traffic that triggers 1 fragmentation or 2 reassembly, aka Bug ID CSCtr56576...

CVE-2011-4007

Cisco IOS 15.0 and 15.1 and IOS XE 3.x do not properly handle the "set mpls experimental imposition" command, which allows remote attackers to cause a denial of service device crash via network traffic that triggers 1 fragmentation or 2 reassembly, aka Bug ID CSCtr56576...

CVE-2011-4007: Improper Input Validation

Cisco IOS 15.0 and 15.1 and IOS XE 3.x do not properly handle the "set mpls experimental imposition" command, which allows remote attackers to cause a denial of service device crash via network traffic that triggers 1 fragmentation or 2 reassembly, aka Bug ID CSCtr56576...

Sourcefire Snort Packet Fragmentation Reassembly Denial of Service (CVE-2007-1398)

A denial of service vulnerability has been reported in Sourcefire Snort. The vulnerability is due to an error in Snort Intrusion Detection System when it reassembles fragmented packets. A remote attacker may exploit this vulnerability by sending malicious packets over UDP to an affected service...

Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow (loop)

The LWRES dissector in Wireshark version 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allows remote attackers to execute arbitrary code due to a stack-based buffer overflow. This bug found and reported by babi. This particular exploit targets the dissectgetaddrsbynamerequest function. Several...

RedHat Update for kernel RHSA-2008:0237-01

Check for the Version of kernel OpenVAS Vulnerability Test RedHat Update for kernel RHSA-2008:0237-01 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

wireshark: crash in the packet reassembling

The fragmentaddwork function in epan/reassemble.c in Wireshark 0.8.19 through 1.0.1 allows remote attackers to cause a denial of service crash via a series of fragmented packets with non-sequential fragmentation offset values, which lead to a buffer over-read...

FreeBSD Security Advisory (FreeBSD-SA-04:04.tcp.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-04:04.tcp.asc SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

FreeBSD Security Advisory (FreeBSD-SA-04:04.tcp.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-04:04.tcp.asc ADV FreeBSD-SA-04:04.tcp.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Snort碎片重组TTL值导致漏报漏洞

BUGTRAQ ID: 29327 CVECAN ID: CVE-2008-1804 Snort是广泛部署的开放源码网络入侵检测系统（IDS）。 Snort没有正确地重组IP报文，远程攻击者可能利用此漏洞绕过检测。 在接收入站碎片时，Snort检查碎片的存活时间（TTL）值并与初始碎片的TTL做比较。如果二者之间的差异大于所配置的量（默认最大值为5）的话，就会丢弃碎片，也无法对其应用规则，这导致Snort无法过滤或检查有效的通讯。 Snort Project Snort 2.8 Snort Project Snort 2.6 临时解决方法：...

CVE-2008-1095

Unspecified vulnerability in the Internet Protocol IP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service panic via unknown vectors, possibly related to ICMP packets and IP fragment reassembly...

Design/Logic Flaw

Unspecified vulnerability in the Internet Protocol IP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service panic via unknown vectors, possibly related to ICMP packets and IP fragment reassembly...

CVE-2008-1095

CVE-2008-1095 affects the Internet Protocol (IP) implementation in Sun Solaris 8, 9, and 10. The vulnerability is described as an unspecified issue that allows remote attackers to bypass firewall policies or cause a denial of service (panic) via unknown vectors, with possible involvement of ICMP ...

CVE-2008-1095: Undefined Security Weakness

Unspecified vulnerability in the Internet Protocol IP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service panic via unknown vectors, possibly related to ICMP packets and IP fragment reassembly...

8e6 Technologies R3000 Internet Filter Bypass by Request Split

8e6 Technologies R3000 Internet Filter Bypass by Request Split Product: 8e6 Technologies R3000 Internet Filter http://www.8e6.com/network-security/internet-filtering/internet-filtering.html The HTTP URL filtering function provided by the 8e6 Technologies R3000 Internet Filter can be bypassed by...

8e6-bypass.txt

8e6 Technologies R3000 Internet Filter Bypass by Request Split Product: 8e6 Technologies R3000 Internet Filter http://www.8e6.com/network-security/internet-filtering/internet-filtering.html The HTTP URL filtering function provided by the 8e6 Technologies R3000 Internet Filter can be bypassed by...

TippingPoint detection bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The following advisory is also available in PDF format for download at: http://www.cybsec.com/vuln/CYBSEC-SecurityPre-Advisory3ComTippingPointIPSDetectionBypass2.pdf CYBSEC S.A. www.cybsec.com Pre-Advisory Name: TippingPoint detection bypass...

IPv6 fragments bypass in nf_conntrack netfilter code

nfconntrack in netfilter in the Linux kernel before 2.6.20.3 does not set nfctinfo during reassembly of fragmented packets, which leaves the default value as IPCTESTABLISHED and might allow remote attackers to bypass certain rulesets using IPv6 fragments...

Linux Kernel Netfilter nf_conntrack IPv6报文重组绕过规则漏洞

Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel中netfilter的模块实现上存在漏洞，远程攻击者可能利用此漏洞绕过访问过滤。 netfilter的nfconntrack函数在重组碎片IPv6报文期间没有设置nfctinfo，将默认值初始化为0，而这是IPCTESTABLISHED的值，因此所有IPv6碎片都追踪为ESTABLISHED，这样攻击者就可以绕过某些接受ESTABLISHED报文的规则组。 Linux kernel 2.6.20.3 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Sun Solaris IP实现远程拒绝服务漏洞

Solaris是一款由Sun开发和维护的商业性质UNIX操作系统。 Solaris 8/9的IP实现上存在安全漏洞，远程非特权用户可能利用此漏洞通过发送特制IP报文降低联网Solaris系统的性能。 Solaris系统上可见大量的伪造IP碎片和/或大量的IP碎片重组失败。例如，运行以下命令： % /usr/bin/netstat -s | /usr/bin/egrep 'ReasmDuplicates|ReasmFails' 可能显示很高的ipv6ReasmDuplicates和ipv6ReasmFails计数器值。 此外，单处理器的Solaris...