PT-2004-2102 · Linux+1 · Linux Kernel+1
Publicado
2004-12-15
·
Atualizado
2018-05-03
·
CVE-2004-1137
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions 2.4.22 through 2.4.28
Linux kernel versions 2.6.x through 2.6.9
Description:
The issue concerns multiple vulnerabilities in the IGMP functionality, allowing local and remote attackers to cause a denial of service or execute arbitrary code. This is achieved through two main functions: the
ip mc source function, which can decrement a counter to -1, and the igmp marksources function, which fails to properly validate IGMP message parameters and performs an out-of-bounds read.Recommendations:
For Linux kernel versions 2.4.22 through 2.4.28, consider upgrading to a version outside of this range to mitigate the risk.
For Linux kernel versions 2.6.x through 2.6.9, consider upgrading to a version outside of this range to mitigate the risk.
As a temporary workaround, consider restricting access to the IGMP functionality until a patch is available.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux Kernel
Red Hat