PT-2004-1718 · Linux+1 · Linux Kernel+2

Published 2004-07-06 · Updated 2017-07-11 · CVE-2004-0626

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Linux kernel version 2.6

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption by an infinite loop, when using iptables and TCP options rules. This occurs due to a large option length that produces a negative integer after a casting operation to the char type in the tcp find option function of the netfilter subsystem.

Recommendations For Linux kernel version 2.6, consider applying configuration changes to restrict the use of TCP options rules with iptables to minimize the risk of exploitation. As a temporary workaround, restrict access to the netfilter subsystem until a patch is available.

Fix

Related Identifiers

CVE-2004-0626

Affected Products

Linux Kernel

Iptables

Netfilter

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2004-0626 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200407-12.xml · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000852 · Vendor Advisory
• http://lwn.net/Articles/91964 · Vendor Advisory
• http://novell.com/linux/security/advisories/2004_20_kernel.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=108861141304495&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16554 · Note