CVE-2008-3584: Input Validation

Published Sep 11, 2008

Updated

NetBSD 3.0, 3.1, and 4.0, when a pppoe instance exists, does not properly check the length of a PPPoE packet tag, which allows remote attackers to cause a denial of service (system crash) via a crafted PPPoE packet.

Affected Software

3 affected components

NetBSD NetBSD=4.0

NetBSD NetBSD=3.1

NetBSD NetBSD=3.0

Event History

Sep 11, 2008

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-3584?

CVE-2008-3584 has a high severity as it can lead to a denial of service through a system crash due to improper handling of PPPoE packets.

How do I fix CVE-2008-3584?

To fix CVE-2008-3584, update your NetBSD system to version 4.1 or later, as the vulnerability is patched in subsequent releases.

What systems are affected by CVE-2008-3584?

CVE-2008-3584 affects NetBSD versions 3.0, 3.1, and 4.0 when a PPPoE instance is present.

Can CVE-2008-3584 be exploited remotely?

Yes, CVE-2008-3584 can be exploited remotely by sending a crafted PPPoE packet to the affected system.

What type of attack does CVE-2008-3584 facilitate?

CVE-2008-3584 facilitates a denial of service attack, potentially crashing the affected NetBSD system.