CVE - CVE-2008-3792

CVE-ID
CVE-2008-3792	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4 does not verify that the SCTP-AUTH extension is enabled before proceeding with SCTP-AUTH API functions, which allows attackers to cause a denial of service (NULL pointer dereference and panic) via vectors that result in calls to (1) sctp_setsockopt_auth_chunk, (2) sctp_setsockopt_hmac_ident, (3) sctp_setsockopt_auth_key, (4) sctp_setsockopt_active_key, (5) sctp_setsockopt_del_key, (6) sctp_getsockopt_maxburst, (7) sctp_getsockopt_active_key, (8) sctp_getsockopt_peer_auth_chunks, or (9) sctp_getsockopt_local_auth_chunks.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BUGTRAQ:20080911 [TKADV2008-007] Linux Kernel SCTP-AUTH API Information Disclosure Vulnerability and NULL Pointer Dereferences URL:http://www.securityfocus.com/archive/1/496256/100/0/threaded MLIST:[linux-kernel] 20080823 [GIT]: Networking URL:http://lkml.org/lkml/2008/8/23/49 MLIST:[linux-netdev] 20080821 [PATCH] sctp: fix potential panics in the SCTP-AUTH API. URL:http://marc.info/?l=linux-netdev&m=121928747903176&w=2 MLIST:[oss-security] 20080825 CVE request: kernel: sctp: fix potential panics in the SCTP-AUTH API URL:http://www.openwall.com/lists/oss-security/2008/08/25/1 MLIST:[oss-security] 20080826 Re: CVE request: kernel: sctp: fix potential panics in the SCTP-AUTH API URL:http://www.openwall.com/lists/oss-security/2008/08/26/6 MLIST:[oss-security] 20080826 Re: CVE request: kernel: sctp: fix potential panics in the SCTP-AUTH API URL:http://www.openwall.com/lists/oss-security/2008/08/26/8 MLIST:[oss-security] 20080926 Re: CVE-2008-4113 update: kernel: sctp: fix random memory dereference with SCTP_HMAC_IDENT option URL:http://www.openwall.com/lists/oss-security/2008/09/26/6 MISC:http://www.trapkit.de/advisories/TKADV2008-007.txt CONFIRM:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5e739d1752aca4e8f3e794d431503bfca3162df4 CONFIRM:http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.26.4 DEBIAN:DSA-1636 URL:http://www.debian.org/security/2008/dsa-1636 REDHAT:RHSA-2008:0857 URL:http://www.redhat.com/support/errata/RHSA-2008-0857.html SUSE:SUSE-SA:2008:053 URL:http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00010.html UBUNTU:USN-659-1 URL:http://www.ubuntu.com/usn/usn-659-1 BID:31121 URL:http://www.securityfocus.com/bid/31121 SECTRACK:1020854 URL:http://www.securitytracker.com/id?1020854 SECUNIA:31881 URL:http://secunia.com/advisories/31881 SECUNIA:32190 URL:http://secunia.com/advisories/32190 SECUNIA:32393 URL:http://secunia.com/advisories/32393 SREASON:4210 URL:http://securityreason.com/securityalert/4210 XF:linux-kernel-sctpauthapi-dos(45189) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/45189
Assigning CNA
N/A
Date Entry Created
20080826	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20080826)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org