PT-2007-3100 · Linux · Linux Kernel

Publicado 2007-03-28 · Atualizado 2018-10-16 · CVE-2007-1734

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 2.6.20 and later

Description: The issue is related to the DCCP support in the Linux kernel, specifically in the do dccp getsockopt function. It does not properly verify the upper bounds of the optlen value, which can be exploited by local users on certain architectures to read kernel memory or cause a denial of service.

Recommendations: For Linux kernel versions 2.6.20 and later, consider restricting access to the do dccp getsockopt function until a patch is available. As a temporary workaround, avoid using the optlen variable in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2007-1734

Produtos afetados

Linux Kernel

Referências · 8

• 🔥 https://exploit-db.com/exploits/3595 · Exploit
• 🔥 https://exploit-db.com/exploits/3587 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43321 · Nota
• http://securityreason.com/securityalert/2511 · Nota
• http://securitytracker.com/id?1017820 · Nota
• http://securityfocus.com/archive/1/463969/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33274 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1734 · Nota de Segurança