CVE-2004-0592: Medium severity SUSE SuSE Linux vulnerability

Published Dec 31, 2004

Updated

The tcpfindoption function of the netfilter subsystem for IPv6 in the SUSE Linux 2.6.5 kernel with USAGI patches, when using iptables and TCP options rules, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a large option length that produces a negative integer after a casting operation to the char type, a similar flaw to CVE-2004-0626.

Affected Software

1 affected component

SUSE SuSE Linux=2.6.5

Remediation

Patch Available

http://www.novell.com/linux/security/advisories/2004_20_kernel.html

Event History

Dec 31, 2004

CVE Published

05:00 AM

Jan 24, 2006

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-0592?

CVE-2004-0592 is classified as a high severity vulnerability due to its potential to cause a denial of service.

How do I fix CVE-2004-0592?

To mitigate CVE-2004-0592, consider upgrading to a later version of the kernel that does not have this vulnerability.

What systems are affected by CVE-2004-0592?

CVE-2004-0592 specifically affects SUSE Linux version 2.6.5 with USAGI patches.

What type of attack is associated with CVE-2004-0592?

CVE-2004-0592 allows remote attackers to exploit a denial of service attack by causing excessive CPU consumption.

Can CVE-2004-0592 be exploited remotely?

Yes, CVE-2004-0592 can be exploited remotely by sending specially crafted TCP options that trigger an infinite loop.