CVE-2008-0177
First published: Thu Feb 07 2008(Updated: )
The ipcomp6_input function in sys/netinet6/ipcomp_input.c in the KAME project before 20071201 does not properly check the return value of the m_pulldown function, which allows remote attackers to cause a denial of service (system crash) via an IPv6 packet with an IPComp header.
Credit: cret@cert.org cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Kame Ipcomp |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet6/ipcomp_input.c?f=u&only_with_tag=netbsd-3-1
- http://www.kame.net/dev/cvsweb2.cgi/kame/kame/sys/netinet6/ipcomp_input.c.diff?r1=1.36;r2=1.37
- http://www.kb.cert.org/vuls/id/110947
- http://www.securityfocus.com/bid/27642
- http://secunia.com/advisories/28788
- http://secunia.com/advisories/28816
- http://securitytracker.com/id?1019314
- http://security.freebsd.org/advisories/FreeBSD-SA-08:04.ipsec.asc
- http://secunia.com/advisories/28979
- http://secunia.com/advisories/29130
- http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
- http://www.us-cert.gov/cas/techalerts/TA08-150A.html
- http://secunia.com/advisories/30430
- http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html
- http://secunia.com/advisories/31074
- http://www.vupen.com/english/advisories/2008/0688
- http://www.vupen.com/english/advisories/2008/1697
- http://www.vupen.com/english/advisories/2008/2094/references
- http://www.vupen.com/english/advisories/2008/0441
- https://www.exploit-db.com/exploits/5191
- http://www.kame.net/dev/cvsweb2.cgi/kame/kame/sys/netinet6/ipcomp_input.c.diff?r1=1.36%3Br2=1.37
Frequently Asked Questions
What is the severity of CVE-2008-0177?
CVE-2008-0177 has a severity rating that indicates it can lead to a denial of service due to a system crash.
How do I fix CVE-2008-0177?
To fix CVE-2008-0177, update to a version of the KAME project that is dated 20071201 or later.
What type of attack does CVE-2008-0177 enable?
CVE-2008-0177 enables remote attackers to trigger a denial of service attack through crafted IPv6 packets.
Which software is affected by CVE-2008-0177?
CVE-2008-0177 affects the Kame Ipcomp implementation prior to the update released on 20071201.
What is the impact of exploiting CVE-2008-0177?
Exploitation of CVE-2008-0177 can lead to a system crash, impacting availability of the affected service.
- collector/nvd-historical
- collector/nvd-index
- collector/nvd-api
- agent/author
- agent/softwarecombine
- agent/remedy
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- vendor/kame
- canonical/kame ipcomp