Описание
Implementations of UDP application protocol are vulnerable to network loops. An unauthenticated attacker can use maliciously-crafted packets against a vulnerable implementation that can lead to Denial of Service (DOS) and/or abuse of resources.
A vulnerability was found in certain UPD protocol implementations. This issue may allow an unauthenticated attacker to send maliciously crafted packages leading to a denial of service on the targeted system. An attacker needs to perform the attack on a vulnerable server in order to meet the conditions to create the necessary traffic-loop for a successful attack.
Отчет
Red Hat is aware of the existence of CVE-2024-2169 and has investigated the impact in several packages distributed across Red Hat Enterprise Linux versions. The versions of the NTP package shipped with Red Hat Enterprise Linux 6 and 7 are not vulnerable to this attack, as this issue was dependent on CVE-2009-3563 present in ntp up to 4.2.4p8 and 4.2.5, which are older than the versions shipped with the mentioned products. Package implementations of DNS (such as dnsmasq and bind), tftp, and dhcp packages as distributed with Red Hat Enterprise Linux are not affected by this vulnerability as all of it uses a random source port for response, making it impossible to perform a traffic-loop attack.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ansible Automation Platform 1.2 | rsyslog | Not affected | ||
| Red Hat Enterprise Linux 10 | bind | Not affected | ||
| Red Hat Enterprise Linux 10 | dhcp | Not affected | ||
| Red Hat Enterprise Linux 10 | dnsmasq | Not affected | ||
| Red Hat Enterprise Linux 10 | net-snmp | Not affected | ||
| Red Hat Enterprise Linux 10 | rsyslog | Not affected | ||
| Red Hat Enterprise Linux 10 | tftp | Not affected | ||
| Red Hat Enterprise Linux 6 | bind | Not affected | ||
| Red Hat Enterprise Linux 6 | dnsmasq | Not affected | ||
| Red Hat Enterprise Linux 6 | net-snmp | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Implementations of UDP application protocol are vulnerable to network loops. An unauthenticated attacker can use maliciously-crafted packets against a vulnerable implementation that can lead to Denial of Service (DOS) and/or abuse of resources.
Implementations of UDP application protocol are vulnerable to network loops. An unauthenticated attacker can use maliciously-crafted packets against a vulnerable implementation that can lead to Denial of Service (DOS) and/or abuse of resources.
Уязвимость реализации прикладных протоколов, использующих протокол UDP, связанная с возможностью реализации спуфинг атак, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3