PT-2008-3929 · Netbsd+2 · Netbsd+2

Jukka Taimisto + 2 · Published 2008-09-10 · Updated 2008-09-11 · CVE-2008-2464

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: NetBSD version 4.0 FreeBSD (affected versions not specified) KAME (affected versions not specified)

Description: The issue is related to a denial of service caused by a divide-by-zero error and panic. This occurs when a malformed ICMPv6 Multicast Listener Discovery (MLD) query with a certain Maximum Response Delay value is sent to the system. The mld input function in the kernel is the vulnerable component.

Recommendations: For NetBSD version 4.0, update the kernel to a version that fixes the mld input function issue. For FreeBSD, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For KAME, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2008-2464

Affected Products

Freebsd

Kame

Netbsd

References · 10

• 🔥 http://cert.fi/haavoittuvuudet/2008/advisory-netbsd.html · Exploit
• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-011.txt.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2464 · Security Note
• http://kb.cert.org/vuls/id/817940 · Note
• http://securityfocus.com/bid/31026 · Note
• http://freebsd.org/cgi/cvsweb.cgi/src/sys/netinet6/mld6.c · Note
• http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet6/mld6.c · Note
• http://freebsd.org/cgi/cvsweb.cgi/src/sys/netinet6/mld6.c.diff?r1=1.34%3Br2=1.35%3Bf=h · Note
• http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet6/mld6.c.diff?r1=1.46&r2=1.47&f=h · Note
• http://securitytracker.com/id?1020822 · Note