kernel: net: acceptation of overlapping ipv6 fragments

The ip6fragqueue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments...

PT-2012-5405 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.36 Description: The issue allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments. This is due to a problem in the ip6 frag queue function in net/ipv6/reassembly.c...

kernel: netfilter: null pointer dereference in nf_ct_frag6_reasm()

net/ipv6/netfilter/nfconntrackreasm.c in the Linux kernel before 2.6.34, when the nfconntrackipv6 module is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and system crash via certain types of fragmented IPv6 packets...

kernel: netfilter: null pointer dereference in nf_ct_frag6_reasm()

net/ipv6/netfilter/nfconntrackreasm.c in the Linux kernel before 2.6.34, when the nfconntrackipv6 module is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and system crash via certain types of fragmented IPv6 packets...

CVE-2011-4007

Cisco IOS 15.0 and 15.1 and IOS XE 3.x do not properly handle the "set mpls experimental imposition" command, which allows remote attackers to cause a denial of service device crash via network traffic that triggers 1 fragmentation or 2 reassembly, aka Bug ID CSCtr56576...

CVE-2011-4007

Cisco IOS 15.0 and 15.1 and IOS XE 3.x do not properly handle the "set mpls experimental imposition" command, which allows remote attackers to cause a denial of service device crash via network traffic that triggers 1 fragmentation or 2 reassembly, aka Bug ID CSCtr56576...

CVE-2011-4007: Improper Input Validation

Cisco IOS 15.0 and 15.1 and IOS XE 3.x do not properly handle the "set mpls experimental imposition" command, which allows remote attackers to cause a denial of service device crash via network traffic that triggers 1 fragmentation or 2 reassembly, aka Bug ID CSCtr56576...

Sourcefire Snort Packet Fragmentation Reassembly Denial of Service (CVE-2007-1398)

A denial of service vulnerability has been reported in Sourcefire Snort. The vulnerability is due to an error in Snort Intrusion Detection System when it reassembles fragmented packets. A remote attacker may exploit this vulnerability by sending malicious packets over UDP to an affected service...

Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow (loop)

The LWRES dissector in Wireshark version 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allows remote attackers to execute arbitrary code due to a stack-based buffer overflow. This bug found and reported by babi. This particular exploit targets the dissectgetaddrsbynamerequest function. Several...

RedHat Update for kernel RHSA-2008:0237-01

Check for the Version of kernel OpenVAS Vulnerability Test RedHat Update for kernel RHSA-2008:0237-01 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

wireshark: crash in the packet reassembling

The fragmentaddwork function in epan/reassemble.c in Wireshark 0.8.19 through 1.0.1 allows remote attackers to cause a denial of service crash via a series of fragmented packets with non-sequential fragmentation offset values, which lead to a buffer over-read...

FreeBSD Security Advisory (FreeBSD-SA-04:04.tcp.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-04:04.tcp.asc ADV FreeBSD-SA-04:04.tcp.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Security Advisory (FreeBSD-SA-04:04.tcp.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-04:04.tcp.asc SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Snort碎片重组TTL值导致漏报漏洞

BUGTRAQ ID: 29327 CVECAN ID: CVE-2008-1804 Snort是广泛部署的开放源码网络入侵检测系统（IDS）。 Snort没有正确地重组IP报文，远程攻击者可能利用此漏洞绕过检测。 在接收入站碎片时，Snort检查碎片的存活时间（TTL）值并与初始碎片的TTL做比较。如果二者之间的差异大于所配置的量（默认最大值为5）的话，就会丢弃碎片，也无法对其应用规则，这导致Snort无法过滤或检查有效的通讯。 Snort Project Snort 2.8 Snort Project Snort 2.6 临时解决方法：...

Design/Logic Flaw

Unspecified vulnerability in the Internet Protocol IP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service panic via unknown vectors, possibly related to ICMP packets and IP fragment reassembly...

CVE-2008-1095

Unspecified vulnerability in the Internet Protocol IP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service panic via unknown vectors, possibly related to ICMP packets and IP fragment reassembly...

CVE-2008-1095

CVE-2008-1095 affects the Internet Protocol (IP) implementation in Sun Solaris 8, 9, and 10. The vulnerability is described as an unspecified issue that allows remote attackers to bypass firewall policies or cause a denial of service (panic) via unknown vectors, with possible involvement of ICMP ...

CVE-2008-1095: Undefined Security Weakness

Unspecified vulnerability in the Internet Protocol IP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service panic via unknown vectors, possibly related to ICMP packets and IP fragment reassembly...

8e6 Technologies R3000 Internet Filter Bypass by Request Split

8e6 Technologies R3000 Internet Filter Bypass by Request Split Product: 8e6 Technologies R3000 Internet Filter http://www.8e6.com/network-security/internet-filtering/internet-filtering.html The HTTP URL filtering function provided by the 8e6 Technologies R3000 Internet Filter can be bypassed by...

8e6-bypass.txt

8e6 Technologies R3000 Internet Filter Bypass by Request Split Product: 8e6 Technologies R3000 Internet Filter http://www.8e6.com/network-security/internet-filtering/internet-filtering.html The HTTP URL filtering function provided by the 8e6 Technologies R3000 Internet Filter can be bypassed by...