PT-2009-4117 · Linux+1 · Linux Kernel+1
Eugene Teo
·
Published
2009-05-28
·
Updated
2018-11-08
·
CVE-2009-1633
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 2.6.29.4
Description:
The issue is related to multiple buffer overflows in the cifs subsystem. These overflows can be triggered by remote CIFS servers, potentially causing a denial of service due to memory corruption. The overflows can occur through two main vectors: (1) a malformed Unicode string, which is related to Unicode string area alignment in fs/cifs/sess.c, or (2) long Unicode characters, related to fs/cifs/cifssmb.c and the
cifs readdir function in fs/cifs/readdir.c.Recommendations:
For Linux kernel versions prior to 2.6.29.4, update to version 2.6.29.4 or later to resolve the issue. As a temporary workaround, consider restricting access to remote CIFS servers to minimize the risk of exploitation. Avoid using long Unicode characters in CIFS operations until the issue is resolved.
Fix
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Red Hat