CVE-2009-2208: Low severity freebsd kernel vulnerability
Published Jun 24, 2009
·Updated
FreeBSD 6.3, 6.4, 7.1, and 7.2 does not enforce permissions on the SIOCSIFINFOIN6 IOCTL, which allows local users to modify or disable IPv6 network interfaces, as demonstrated by modifying the MTU.
Affected Software
26 affected components
FreeBSD FreeBSD=6.4-release_p2
FreeBSD FreeBSD=6.4
FreeBSD FreeBSD=6.3
FreeBSD FreeBSD=6.4-release_p5
FreeBSD FreeBSD=6.3_releng
FreeBSD FreeBSD=7.1-release-p2
FreeBSD FreeBSD=7.1-rc1
FreeBSD FreeBSD=6.4-release
FreeBSD FreeBSD=7.1-release-p1
FreeBSD FreeBSD=7.1-stable
FreeBSD FreeBSD=6.3-release_p9
FreeBSD FreeBSD=7.1-release-p6
FreeBSD FreeBSD=6.4-stable
FreeBSD FreeBSD=6.4-release_p4
FreeBSD FreeBSD=6.3-release_p6
FreeBSD FreeBSD=7.2-pre-release
FreeBSD FreeBSD=7.1
FreeBSD FreeBSD=7.2
FreeBSD FreeBSD=6.3-release_p10
FreeBSD FreeBSD=7.1-pre-release
FreeBSD FreeBSD=6.4-release_p3
FreeBSD FreeBSD=7.1-release-p4
FreeBSD FreeBSD=6.3-release_p11
FreeBSD FreeBSD=6.3-release_p8
FreeBSD FreeBSD=7.1-release-p5
FreeBSD FreeBSD=7.2-stable
Remediation
Patch Available
Event History
Jun 24, 2009
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2208?
CVE-2009-2208 has a medium severity level due to its potential to allow unauthorized modification of IPv6 network interfaces.
2
How do I fix CVE-2009-2208?
To fix CVE-2009-2208, upgrade to a patched version of FreeBSD that enforces proper permissions for the SIOCSIFINFO_IN6 IOCTL.
3
Who is affected by CVE-2009-2208?
CVE-2009-2208 affects local users on FreeBSD versions 6.3 through 7.2.
4
What can an attacker do with CVE-2009-2208?
An attacker exploiting CVE-2009-2208 can modify or disable IPv6 network interfaces, which could lead to network disruption.
5
When was CVE-2009-2208 discovered?
CVE-2009-2208 was disclosed in July 2009.