PT-2012-1994 · Linux+1 · Linux Kernel+1

Dan Rosenberg · Publicado 2012-06-21 · Atualizado 2023-02-13 · CVE-2011-4913

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.39

Description The issue is related to the rose parse ccitt function in the Linux kernel, which does not validate certain fields. This allows remote attackers to cause a denial of service or conduct stack-based buffer overflow attacks via specially crafted data sent to a ROSE socket.

Recommendations For Linux kernel versions prior to 2.6.39, update to version 2.6.39 or later to resolve the issue.

Exploit

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-4913

DSA-2240-1

DSA-2264-1

Produtos afetados

Linux Kernel

Suse

Referências · 7

• 🔥 https://github.com/torvalds/linux/commit/be20250c13f88375345ad99950190685eda51eb8 · Exploit
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=be20250c13f88375345ad99950190685eda51eb8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4913 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=770777 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html · Aviso do Fabricante
• http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39 · Nota
• http://openwall.com/lists/oss-security/2011/12/28/2 · Nota