CVE-2009-2698

Опубликовано: 27 авг. 2009

Источник: nvd

CVSS3: 7.8

CVSS2: 7.2

EPSS Средний

Описание

The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.

Ссылки

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1e0c14f49d6b393179f423abbac47f85618d3d46
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00008.html
Mailing List
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2009-1222.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2009-1223.html
Third Party Advisory
http://secunia.com/advisories/23073
Broken Link
Vendor Advisory
http://secunia.com/advisories/36430
Broken Link
Vendor Advisory
http://secunia.com/advisories/36510
Broken Link
Vendor Advisory
http://secunia.com/advisories/37105
Broken Link
Vendor Advisory
http://secunia.com/advisories/37298
Broken Link
Vendor Advisory
http://secunia.com/advisories/37471
Broken Link
Vendor Advisory
http://support.avaya.com/css/P8/documents/100067254
Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19
Broken Link
Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2011:051
Broken Link
Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/08/25/1
Mailing List
http://www.redhat.com/support/errata/RHSA-2009-1233.html
Broken Link
Third Party Advisory
http://www.securityfocus.com/archive/1/507985/100/0/threaded
Broken Link
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/512019/100/0/threaded
Broken Link
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/36108
Broken Link
Exploit
Patch
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id?1022761
Broken Link
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-852-1
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия до 2.6.19 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:4.8:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:5.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:4.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:5.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:a:vmware:vcenter_server:4.0:-:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.21801

Средний

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-476

Связанные уязвимости

CVE-2009-2698

CVSS3: 7.8

ubuntu

почти 16 лет назад

CVE-2009-2698

redhat

почти 16 лет назад

CVE-2009-2698

CVSS3: 7.8

debian

почти 16 лет назад

The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp ...

GHSA-x9j9-wxm6-8cvm

CVSS3: 7.8

github

больше 3 лет назад

BDU:2015-04198

fstec

больше 10 лет назад

Уязвимость операционной системы SUSE Linux Enterprise, позволяющая злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

EPSS

Процентиль: 95%

0.21801

Средний

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-476