CVE-2009-4067: Buffer Overflow
A buffer overflow flaw was found in the Linux kernel's Auerswald PBX/System Telephone usb driver implementation. There's no upstream patch as the affected driver was removed from the kernel in 2.6.27.
For more information, check out the references: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4067 http://labs.mwrinfosecurity.com/files/Advisories/mwrilinux-usb-buffer-overflow2009-10-29.pdf
Acknowledgement:
Red Hat would like to thank Rafael Dominguez Vega for reporting this issue.
Other sources
Buffer overflow in the auerswaldprobe function in the Auerswald Linux USB driver for the Linux kernel before 2.6.27 allows physically proximate attackers to execute arbitrary code, cause a denial of service via a crafted USB device, or take full control of the system.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4067?
CVE-2009-4067 is assigned a high severity rating due to its buffer overflow vulnerability in the Linux kernel's USB driver.
How do I fix CVE-2009-4067?
The specific driver affected by CVE-2009-4067 has been removed from the kernel as of version 2.6.27, so upgrading to this version or later is recommended.
What systems are affected by CVE-2009-4067?
CVE-2009-4067 affects Linux kernels up to version 2.6.26 and specific systems like Red Hat Enterprise Linux 4.0.
Is there an official patch for CVE-2009-4067?
There is no official patch for CVE-2009-4067 as the affected USB driver has been removed from the kernel.
What is the nature of the vulnerability in CVE-2009-4067?
CVE-2009-4067 is a buffer overflow vulnerability that can potentially allow attackers to execute arbitrary code.