PT-2004-1745 · Ieee · Ieee 1394 Driver

Publicado 2004-07-13 · Atualizado 2017-07-11 · CVE-2004-0658

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IEEE 1394 (Firewire) driver versions 2.4 and 2.6

Description The issue is related to an integer overflow in the hpsb alloc packet function, which can be exploited by local users to cause a denial of service or possibly execute arbitrary code. This can be achieved through the functions raw1394 write, state connected, handle remote request, or hpsb make writebpacket.

Recommendations For IEEE 1394 (Firewire) driver version 2.4, consider disabling the raw1394 write function as a temporary workaround until a patch is available. For IEEE 1394 (Firewire) driver version 2.6, restrict access to the state connected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-0658

Produtos afetados

Ieee 1394 Driver

Referências · 3

• https://exchange.xforce.ibmcloud.com/vulnerabilities/16480 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0658 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=108793792820740 · Nota