ByteOS Network

NVD Vulnerability Details :

CVE-2008-3792

Modified

Source-cve@mitre.org

Published At-03 Sep, 2008 | 14:12

Updated At-07 Nov, 2023 | 02:02

net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4 does not verify that the SCTP-AUTH extension is enabled before proceeding with SCTP-AUTH API functions, which allows attackers to cause a denial of service (NULL pointer dereference and panic) via vectors that result in calls to (1) sctp_setsockopt_auth_chunk, (2) sctp_setsockopt_hmac_ident, (3) sctp_setsockopt_auth_key, (4) sctp_setsockopt_active_key, (5) sctp_setsockopt_del_key, (6) sctp_getsockopt_maxburst, (7) sctp_getsockopt_active_key, (8) sctp_getsockopt_peer_auth_chunks, or (9) sctp_getsockopt_local_auth_chunks.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	7.1	HIGH	AV:N/AC:M/Au:N/C:N/I:N/A:C

CPE Matches

Linux Kernel Organization, Inc

>>linux_kernel>>2.6.26.3

cpe:2.3:o:linux:linux_kernel:2.6.26.3:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-Other	Primary	nvd@nist.gov

Vendor Statements

Organization : Red Hat

Last Modified : 2009-01-15T00:00:00

This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and 5. It was addressed in Red Hat Enterprise MRG for RHEL-5 via: https://rhn.redhat.com/errata/RHSA-2008-0857.html

References

Hyperlink	Source	Resource
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5e739d1752aca4e8f3e794d431503bfca3162df4	cve@mitre.org	N/A
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00010.html	cve@mitre.org	N/A
http://lkml.org/lkml/2008/8/23/49	cve@mitre.org	N/A
http://marc.info/?l=linux-netdev&m=121928747903176&w=2	cve@mitre.org	N/A
http://secunia.com/advisories/31881	cve@mitre.org	Vendor Advisory
http://secunia.com/advisories/32190	cve@mitre.org	Vendor Advisory
http://secunia.com/advisories/32393	cve@mitre.org	Vendor Advisory
http://securityreason.com/securityalert/4210	cve@mitre.org	Exploit
http://www.debian.org/security/2008/dsa-1636	cve@mitre.org	Patch
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.26.4	cve@mitre.org	Vendor Advisory
http://www.openwall.com/lists/oss-security/2008/08/25/1	cve@mitre.org	N/A
http://www.openwall.com/lists/oss-security/2008/08/26/6	cve@mitre.org	N/A
http://www.openwall.com/lists/oss-security/2008/08/26/8	cve@mitre.org	N/A
http://www.openwall.com/lists/oss-security/2008/09/26/6	cve@mitre.org	N/A
http://www.redhat.com/support/errata/RHSA-2008-0857.html	cve@mitre.org	N/A
http://www.securityfocus.com/archive/1/496256/100/0/threaded	cve@mitre.org	N/A
http://www.securityfocus.com/bid/31121	cve@mitre.org	Exploit Patch
http://www.securitytracker.com/id?1020854	cve@mitre.org	N/A
http://www.trapkit.de/advisories/TKADV2008-007.txt	cve@mitre.org	N/A
http://www.ubuntu.com/usn/usn-659-1	cve@mitre.org	N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/45189	cve@mitre.org	N/A

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History