PT-2006-4097 · Netbsd · Netbsd

Christian Biere · Published 2006-06-23 · Updated 2017-07-20 · CVE-2006-3202

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions NetBSD versions 2.0 through 3.0

Description The issue concerns the ip6 savecontrol function, which under certain configurations, fails to check if IPv4-mapped sockets are being used before processing IPv6 socket options. This allows local users to cause a denial of service by creating an IPv4-mapped IPv6 socket with the SO TIMESTAMP socket option set and then sending an IPv4 packet through the socket.

Recommendations For NetBSD versions 2.0 through 3.0, consider disabling the use of IPv4-mapped sockets or restricting the SO TIMESTAMP socket option to prevent exploitation until a fix is available.

Fix

Related Identifiers

CVE-2006-3202

Affected Products

Netbsd

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-3202 · Security Note
• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-016.txt.asc · Vendor Advisory
• http://securitytracker.com/id?1016250 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27139 · Note