CERT-In Vulnerability Note
CIVN-2009-0155
Linux Kernel 'ip_frag_reasm' Null Pointer Deference Remote Denial of Service Vulnerability
Original Issue Date:December 17, 2009
Severity Rating: HIGH
Systems Affected
- Linux Kernel versions prior to 2.6.31.6
Overview
A vulnerability has been reported in Linux kernel, which could be exploited by remote attackers to cause Denial of Service DoS conditions.
Description
This vulnerability is caused due to an error in the " ip_defrag " function in net/ipv4/ip_fragment.c file in Linux kernel .
A remote attacker could exploit this vulnerability by sending overly large size packets to trigger a NULL pointer dereference error. Successful exploitation of this vulnerability could allow a remote attacker to cause Denial of Service DoS conditions.
Solution
Upgrade to Linux Kernel version 2.6.31.6
http://www.kernel.org/
Vendor Information
kernel.org
http://www.kernel.org/
References
kernel.org
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.6
Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=544144
Secunia
http://secunia.com/advisories/37624
SecurityFocus
http://www.securityfocus.com/bid/37231
CVE Name
CVE-2009-1298
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|