Description
The ipcomp6_input function in sys/netinet6/ipcomp_input.c in the KAME project before 20071201 does not properly check the return value of the m_pulldown function, which allows remote attackers to cause a denial of service (system crash) via an IPv6 packet with an IPComp header.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://secunia.com/advisories/28816 ↗
- http://www.vupen.com/english/advisories/2008/0688 ↗
- http://www.vupen.com/english/advisories/2008/0441 ↗
- http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet6/ipcomp_input.c?f=u&only_with_tag=netbsd-3-1 ↗
- http://www.securityfocus.com/bid/27642 ↗
- http://secunia.com/advisories/28788 ↗
- http://security.freebsd.org/advisories/FreeBSD-SA-08:04.ipsec.asc ↗
- http://www.us-cert.gov/cas/techalerts/TA08-150A.html ↗
- http://secunia.com/advisories/29130 ↗
- http://secunia.com/advisories/28979 ↗
- http://secunia.com/advisories/30430 ↗
- http://lists.apple.com/archives/security-announce/2008//May/msg00001.html ↗
- http://www.kame.net/dev/cvsweb2.cgi/kame/kame/sys/netinet6/ipcomp_input.c.diff?r1=1.36%3Br2=1.37 ↗
- http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html ↗
- http://www.vupen.com/english/advisories/2008/2094/references ↗
- http://www.vupen.com/english/advisories/2008/1697 ↗
- http://securitytracker.com/id?1019314 ↗
- http://www.kb.cert.org/vuls/id/110947 ↗
- http://secunia.com/advisories/31074 ↗
- https://www.exploit-db.com/exploits/5191 ↗