PT-2001-1104 · Linux+1 · Linux+1

Published 2001-03-12 · Updated 2016-10-18 · CVE-2000-0314

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions NetBSD version 1.3.3 Linux systems (affected versions not specified)

Description The issue allows local users to flood other systems by exploiting the traceroute command. This is achieved by providing a large waittime option, which is not properly parsed and results in setting the time delay for sending packets to zero.

Recommendations For NetBSD version 1.3.3, avoid using the -w option with large values in the traceroute command until a fix is available. For Linux systems, restrict the use of the traceroute command with the -w option to prevent flooding attacks, and consider implementing rate limiting on outgoing packets.

Fix

Related Identifiers

CVE-2000-0314

Affected Products

Linux

Netbsd

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2000-0314 · Security Note
• ftp://ftp.netbsd.org/pub/NetBSD/misc/security/advisories/NetBSD-SA1999-004.txt.asc · Vendor Advisory
• http://osvdb.org/7574 · Note
• http://marc.info/?l=bugtraq&m=91893782027835&w=2 · Note