CVE-2013-5209: Infoleak
The sctpsendinitiateack function in sys/netinet/sctpoutput.c in the SCTP implementation in the kernel in FreeBSD 8.3 through 9.2-PRERELEASE does not properly initialize the state-cookie data structure, which allows remote attackers to obtain sensitive information from kernel stack memory by reading packet data in INIT-ACK chunks.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5209?
CVE-2013-5209 is classified as a medium severity vulnerability.
How do I fix CVE-2013-5209?
To fix CVE-2013-5209, update your FreeBSD system to the latest version that includes the security patch.
Which versions of FreeBSD are affected by CVE-2013-5209?
CVE-2013-5209 affects FreeBSD versions 8.3 through 9.2-PRERELEASE.
What type of vulnerability is CVE-2013-5209?
CVE-2013-5209 is a vulnerability in the SCTP implementation that may allow information disclosure from the kernel stack.
Can CVE-2013-5209 be exploited remotely?
Yes, CVE-2013-5209 can be exploited remotely by attackers to obtain sensitive information.