PT-2006-1521 · Linux · Linux Kernel

Herbert Xu · Published 2006-02-07 · Updated 2018-10-19 · CVE-2006-0454

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.15.3

Description The issue arises when constructing an ICMP response in the icmp send function, which fails to properly handle the failure of the ip options echo function in icmp.c. This allows remote attackers to cause a denial of service (crash) through specific vectors, including the use of record-route and timestamp IP options with the needaddr bit set and a truncated value.

Recommendations For Linux kernel versions prior to 2.6.15.3, update to version 2.6.15.3 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2006-0454

Affected Products

Linux Kernel

References · 19

• http://secunia.com/advisories/18861 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_06_kernel.html · Vendor Advisory
• http://secunia.com/advisories/18784 · Vendor Advisory
• http://trustix.org/errata/2006/0006 · Vendor Advisory
• http://vupen.com/english/advisories/2006/0464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0454 · Security Note
• http://secunia.com/advisories/18774 · Vendor Advisory
• http://securityfocus.com/archive/1/427981/100/0/threaded · Vendor Advisory
• http://secunia.com/advisories/18766 · Vendor Advisory
• http://redhat.com/archives/fedora-announce-list/2006-February/msg00037.html · Vendor Advisory
• http://ubuntu.com/usn/usn-250-1 · Vendor Advisory
• http://lists.immunitysec.com/pipermail/dailydave/2006-February/002909.html · Patch
• http://secunia.com/advisories/18788 · Vendor Advisory
• http://securityfocus.com/bid/16532 · Patch
• http://mandriva.com/security/advisories?name=MDKSA-2006:040 · Vendor Advisory