PT-2008-4914 · Netbsd Foundation+1 · Netbsd+1

Bjoern A. Zeeb + 1 · Published 2008-09-05 · Updated 2017-08-08 · CVE-2008-3530

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 6.3 through 7.1 NetBSD versions 3.0 through 4.0

Description The issue is related to the improper checking of the proposed new MTU in an ICMPv6 Packet Too Big Message. This allows remote attackers to cause a denial of service, resulting in a system panic, via a crafted Packet Too Big Message.

Recommendations For FreeBSD versions 6.3 through 7.1, update to a version that properly checks the proposed new MTU in an ICMPv6 Packet Too Big Message. For NetBSD versions 3.0 through 4.0, update to a version that properly checks the proposed new MTU in an ICMPv6 Packet Too Big Message.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-3530

Affected Products

Freebsd

Netbsd

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2008-3530 · Security Note
• http://securityfocus.com/bid/31004 · Patch
• http://lists.apple.com/archives/security-announce/2009/May/msg00002.html · Vendor Advisory
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-015.txt.asc · Vendor Advisory
• http://secunia.com/advisories/31745 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1297 · Note
• http://securitytracker.com/id?1021111 · Note
• http://support.apple.com/kb/HT3467 · Note
• http://secunia.com/advisories/32401 · Note
• http://vupen.com/english/advisories/2009/0633 · Note
• http://securitytracker.com/id?1020820 · Note
• http://secunia.com/advisories/35074 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44908 · Note
• http://support.apple.com/kb/HT3549 · Note
• http://security.freebsd.org/advisories/FreeBSD-SA-08:09.icmp6.asc · Patch, Vendor Advisory