Search
Find a vulnerability
Search criteria
4 vulnerabilities by trustedbsd
CVE-2008-4609 (GCVE-0-2008-4609)
Vulnerability from nvd – Published: 2008-10-20 17:00 – Updated: 2024-08-07 10:24
VLAI
EPSS
VEX
Summary
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
15 references
Date Public
2008-10-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T10:24:20.677Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://blog.robertlee.name/2008/10/conjecture-speculation.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html"
},
{
"name": "HPSBMI02473",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=125856010926699\u0026w=2"
},
{
"name": "[dailydave] 20081002 TCP Resource Exhaustion DoS Attack Speculation",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://insecure.org/stf/tcp-dos-attack-explained.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.outpost24.com/news/news-2008-10-02.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf"
},
{
"name": "20090908 TCP State Manipulation Denial of Service Vulnerabilities in Multiple Cisco Products",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml"
},
{
"name": "TA09-251A",
"tags": [
"third-party-advisory",
"x_refsource_CERT",
"x_transferred"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA09-251A.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html"
},
{
"name": "20081017 Cisco Response to Outpost24 TCP State Table Manipulation Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "http://www.cisco.com/en/US/products/products_security_response09186a0080a15120.html"
},
{
"name": "MS09-048",
"tags": [
"vendor-advisory",
"x_refsource_MS",
"x_transferred"
],
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked"
},
{
"name": "oval:org.mitre.oval:def:6340",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6340"
},
{
"name": "MDVSA-2013:150",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"
},
{
"name": "SSRT080138",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=125856010926699\u0026w=2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-10-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-12T19:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://blog.robertlee.name/2008/10/conjecture-speculation.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html"
},
{
"name": "HPSBMI02473",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=125856010926699\u0026w=2"
},
{
"name": "[dailydave] 20081002 TCP Resource Exhaustion DoS Attack Speculation",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://insecure.org/stf/tcp-dos-attack-explained.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.outpost24.com/news/news-2008-10-02.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf"
},
{
"name": "20090908 TCP State Manipulation Denial of Service Vulnerabilities in Multiple Cisco Products",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml"
},
{
"name": "TA09-251A",
"tags": [
"third-party-advisory",
"x_refsource_CERT"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA09-251A.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html"
},
{
"name": "20081017 Cisco Response to Outpost24 TCP State Table Manipulation Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "http://www.cisco.com/en/US/products/products_security_response09186a0080a15120.html"
},
{
"name": "MS09-048",
"tags": [
"vendor-advisory",
"x_refsource_MS"
],
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked"
},
{
"name": "oval:org.mitre.oval:def:6340",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6340"
},
{
"name": "MDVSA-2013:150",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"
},
{
"name": "SSRT080138",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=125856010926699\u0026w=2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-4609",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://blog.robertlee.name/2008/10/conjecture-speculation.html",
"refsource": "MISC",
"url": "http://blog.robertlee.name/2008/10/conjecture-speculation.html"
},
{
"name": "https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html",
"refsource": "MISC",
"url": "https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html"
},
{
"name": "HPSBMI02473",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=125856010926699\u0026w=2"
},
{
"name": "[dailydave] 20081002 TCP Resource Exhaustion DoS Attack Speculation",
"refsource": "MLIST",
"url": "http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html"
},
{
"name": "http://insecure.org/stf/tcp-dos-attack-explained.html",
"refsource": "MISC",
"url": "http://insecure.org/stf/tcp-dos-attack-explained.html"
},
{
"name": "http://www.outpost24.com/news/news-2008-10-02.html",
"refsource": "MISC",
"url": "http://www.outpost24.com/news/news-2008-10-02.html"
},
{
"name": "http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf",
"refsource": "MISC",
"url": "http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf"
},
{
"name": "20090908 TCP State Manipulation Denial of Service Vulnerabilities in Multiple Cisco Products",
"refsource": "CISCO",
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml"
},
{
"name": "TA09-251A",
"refsource": "CERT",
"url": "http://www.us-cert.gov/cas/techalerts/TA09-251A.html"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html"
},
{
"name": "20081017 Cisco Response to Outpost24 TCP State Table Manipulation Denial of Service Vulnerabilities",
"refsource": "CISCO",
"url": "http://www.cisco.com/en/US/products/products_security_response09186a0080a15120.html"
},
{
"name": "MS09-048",
"refsource": "MS",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048"
},
{
"name": "http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked",
"refsource": "MISC",
"url": "http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked"
},
{
"name": "oval:org.mitre.oval:def:6340",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6340"
},
{
"name": "MDVSA-2013:150",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"
},
{
"name": "SSRT080138",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=125856010926699\u0026w=2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-4609",
"datePublished": "2008-10-20T17:00:00.000Z",
"dateReserved": "2008-10-20T00:00:00.000Z",
"dateUpdated": "2024-08-07T10:24:20.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-6013 (GCVE-0-2006-6013)
Vulnerability from nvd – Published: 2006-11-21 23:00 – Updated: 2024-08-07 20:12
VLAI
EPSS
VEX
Summary
Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows local users to read arbitrary memory contents via certain negative values of crom_buf->len in an FW_GCROM command. NOTE: this issue has been labeled as an integer overflow, but it is more like an integer signedness error.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
19 references
Date Public
2006-11-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:12:31.364Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20061116 Re: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/451861/100/0/threaded"
},
{
"name": "1017344",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017344"
},
{
"name": "20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0261.html"
},
{
"name": "20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/451637/100/0/threaded"
},
{
"name": "[tech-security] 20061116 Re: [Full-disclosure] NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://mail-index.netbsd.org/tech-security/2006/11/16/0001.html"
},
{
"name": "FreeBSD-SA-06:25",
"tags": [
"vendor-advisory",
"x_refsource_FREEBSD",
"x_transferred"
],
"url": "http://security.freebsd.org/advisories/FreeBSD-SA-06:25.kmem.asc"
},
{
"name": "freebsd-fwdev-integer-overflow(30347)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30347"
},
{
"name": "20061121 Clarifying integer overflows vs. signedness errors",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/452264/100/0/threaded"
},
{
"name": "20061122 Re: Clarifying integer overflows vs. signedness errors",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/452331/100/0/threaded"
},
{
"name": "20061120 RE: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/452124/100/0/threaded"
},
{
"name": "[tech-security] 20061214 NetBSD Security Note 20061214-1: Kernel memory leakage in firewire interface",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://mail-index.netbsd.org/tech-security/2006/12/14/0002.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.dragonflybsd.org/cvsweb/src/sys/bus/firewire/fwdev.c"
},
{
"name": "21089",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/21089"
},
{
"name": "22917",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/22917"
},
{
"name": "20061115 TrustedBSD* all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/451698/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/ieee1394/fwdev.c"
},
{
"name": "20061115 DragonFlyBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/451677/100/0/threaded"
},
{
"name": "20061115 FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/451629/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.kernelhacking.com/bsdadv1.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows local users to read arbitrary memory contents via certain negative values of crom_buf-\u003elen in an FW_GCROM command. NOTE: this issue has been labeled as an integer overflow, but it is more like an integer signedness error."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T20:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20061116 Re: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/451861/100/0/threaded"
},
{
"name": "1017344",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017344"
},
{
"name": "20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0261.html"
},
{
"name": "20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/451637/100/0/threaded"
},
{
"name": "[tech-security] 20061116 Re: [Full-disclosure] NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://mail-index.netbsd.org/tech-security/2006/11/16/0001.html"
},
{
"name": "FreeBSD-SA-06:25",
"tags": [
"vendor-advisory",
"x_refsource_FREEBSD"
],
"url": "http://security.freebsd.org/advisories/FreeBSD-SA-06:25.kmem.asc"
},
{
"name": "freebsd-fwdev-integer-overflow(30347)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30347"
},
{
"name": "20061121 Clarifying integer overflows vs. signedness errors",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/452264/100/0/threaded"
},
{
"name": "20061122 Re: Clarifying integer overflows vs. signedness errors",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/452331/100/0/threaded"
},
{
"name": "20061120 RE: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/452124/100/0/threaded"
},
{
"name": "[tech-security] 20061214 NetBSD Security Note 20061214-1: Kernel memory leakage in firewire interface",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://mail-index.netbsd.org/tech-security/2006/12/14/0002.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.dragonflybsd.org/cvsweb/src/sys/bus/firewire/fwdev.c"
},
{
"name": "21089",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/21089"
},
{
"name": "22917",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/22917"
},
{
"name": "20061115 TrustedBSD* all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/451698/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/ieee1394/fwdev.c"
},
{
"name": "20061115 DragonFlyBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/451677/100/0/threaded"
},
{
"name": "20061115 FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/451629/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.kernelhacking.com/bsdadv1.txt"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6013",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows local users to read arbitrary memory contents via certain negative values of crom_buf-\u003elen in an FW_GCROM command. NOTE: this issue has been labeled as an integer overflow, but it is more like an integer signedness error."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20061116 Re: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/451861/100/0/threaded"
},
{
"name": "1017344",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017344"
},
{
"name": "20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0261.html"
},
{
"name": "20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/451637/100/0/threaded"
},
{
"name": "[tech-security] 20061116 Re: [Full-disclosure] NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "MLIST",
"url": "http://mail-index.netbsd.org/tech-security/2006/11/16/0001.html"
},
{
"name": "FreeBSD-SA-06:25",
"refsource": "FREEBSD",
"url": "http://security.freebsd.org/advisories/FreeBSD-SA-06:25.kmem.asc"
},
{
"name": "freebsd-fwdev-integer-overflow(30347)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30347"
},
{
"name": "20061121 Clarifying integer overflows vs. signedness errors",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/452264/100/0/threaded"
},
{
"name": "20061122 Re: Clarifying integer overflows vs. signedness errors",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/452331/100/0/threaded"
},
{
"name": "20061120 RE: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/452124/100/0/threaded"
},
{
"name": "[tech-security] 20061214 NetBSD Security Note 20061214-1: Kernel memory leakage in firewire interface",
"refsource": "MLIST",
"url": "http://mail-index.netbsd.org/tech-security/2006/12/14/0002.html"
},
{
"name": "http://www.dragonflybsd.org/cvsweb/src/sys/bus/firewire/fwdev.c",
"refsource": "MISC",
"url": "http://www.dragonflybsd.org/cvsweb/src/sys/bus/firewire/fwdev.c"
},
{
"name": "21089",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/21089"
},
{
"name": "22917",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/22917"
},
{
"name": "20061115 TrustedBSD* all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/451698/100/0/threaded"
},
{
"name": "http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/ieee1394/fwdev.c",
"refsource": "CONFIRM",
"url": "http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/ieee1394/fwdev.c"
},
{
"name": "20061115 DragonFlyBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/451677/100/0/threaded"
},
{
"name": "20061115 FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/451629/100/0/threaded"
},
{
"name": "http://www.kernelhacking.com/bsdadv1.txt",
"refsource": "MISC",
"url": "http://www.kernelhacking.com/bsdadv1.txt"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6013",
"datePublished": "2006-11-21T23:00:00.000Z",
"dateReserved": "2006-11-21T00:00:00.000Z",
"dateUpdated": "2024-08-07T20:12:31.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-4609 (GCVE-0-2008-4609)
Vulnerability from cvelistv5 – Published: 2008-10-20 17:00 – Updated: 2024-08-07 10:24
VLAI
EPSS
VEX
Summary
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
15 references
Date Public
2008-10-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T10:24:20.677Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://blog.robertlee.name/2008/10/conjecture-speculation.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html"
},
{
"name": "HPSBMI02473",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=125856010926699\u0026w=2"
},
{
"name": "[dailydave] 20081002 TCP Resource Exhaustion DoS Attack Speculation",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://insecure.org/stf/tcp-dos-attack-explained.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.outpost24.com/news/news-2008-10-02.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf"
},
{
"name": "20090908 TCP State Manipulation Denial of Service Vulnerabilities in Multiple Cisco Products",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml"
},
{
"name": "TA09-251A",
"tags": [
"third-party-advisory",
"x_refsource_CERT",
"x_transferred"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA09-251A.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html"
},
{
"name": "20081017 Cisco Response to Outpost24 TCP State Table Manipulation Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "http://www.cisco.com/en/US/products/products_security_response09186a0080a15120.html"
},
{
"name": "MS09-048",
"tags": [
"vendor-advisory",
"x_refsource_MS",
"x_transferred"
],
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked"
},
{
"name": "oval:org.mitre.oval:def:6340",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6340"
},
{
"name": "MDVSA-2013:150",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"
},
{
"name": "SSRT080138",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=125856010926699\u0026w=2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-10-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-12T19:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://blog.robertlee.name/2008/10/conjecture-speculation.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html"
},
{
"name": "HPSBMI02473",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=125856010926699\u0026w=2"
},
{
"name": "[dailydave] 20081002 TCP Resource Exhaustion DoS Attack Speculation",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://insecure.org/stf/tcp-dos-attack-explained.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.outpost24.com/news/news-2008-10-02.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf"
},
{
"name": "20090908 TCP State Manipulation Denial of Service Vulnerabilities in Multiple Cisco Products",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml"
},
{
"name": "TA09-251A",
"tags": [
"third-party-advisory",
"x_refsource_CERT"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA09-251A.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html"
},
{
"name": "20081017 Cisco Response to Outpost24 TCP State Table Manipulation Denial of Service Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "http://www.cisco.com/en/US/products/products_security_response09186a0080a15120.html"
},
{
"name": "MS09-048",
"tags": [
"vendor-advisory",
"x_refsource_MS"
],
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked"
},
{
"name": "oval:org.mitre.oval:def:6340",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6340"
},
{
"name": "MDVSA-2013:150",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"
},
{
"name": "SSRT080138",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=125856010926699\u0026w=2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-4609",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://blog.robertlee.name/2008/10/conjecture-speculation.html",
"refsource": "MISC",
"url": "http://blog.robertlee.name/2008/10/conjecture-speculation.html"
},
{
"name": "https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html",
"refsource": "MISC",
"url": "https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html"
},
{
"name": "HPSBMI02473",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=125856010926699\u0026w=2"
},
{
"name": "[dailydave] 20081002 TCP Resource Exhaustion DoS Attack Speculation",
"refsource": "MLIST",
"url": "http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html"
},
{
"name": "http://insecure.org/stf/tcp-dos-attack-explained.html",
"refsource": "MISC",
"url": "http://insecure.org/stf/tcp-dos-attack-explained.html"
},
{
"name": "http://www.outpost24.com/news/news-2008-10-02.html",
"refsource": "MISC",
"url": "http://www.outpost24.com/news/news-2008-10-02.html"
},
{
"name": "http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf",
"refsource": "MISC",
"url": "http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf"
},
{
"name": "20090908 TCP State Manipulation Denial of Service Vulnerabilities in Multiple Cisco Products",
"refsource": "CISCO",
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml"
},
{
"name": "TA09-251A",
"refsource": "CERT",
"url": "http://www.us-cert.gov/cas/techalerts/TA09-251A.html"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html"
},
{
"name": "20081017 Cisco Response to Outpost24 TCP State Table Manipulation Denial of Service Vulnerabilities",
"refsource": "CISCO",
"url": "http://www.cisco.com/en/US/products/products_security_response09186a0080a15120.html"
},
{
"name": "MS09-048",
"refsource": "MS",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048"
},
{
"name": "http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked",
"refsource": "MISC",
"url": "http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked"
},
{
"name": "oval:org.mitre.oval:def:6340",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6340"
},
{
"name": "MDVSA-2013:150",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"
},
{
"name": "SSRT080138",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=125856010926699\u0026w=2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-4609",
"datePublished": "2008-10-20T17:00:00.000Z",
"dateReserved": "2008-10-20T00:00:00.000Z",
"dateUpdated": "2024-08-07T10:24:20.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-6013 (GCVE-0-2006-6013)
Vulnerability from cvelistv5 – Published: 2006-11-21 23:00 – Updated: 2024-08-07 20:12
VLAI
EPSS
VEX
Summary
Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows local users to read arbitrary memory contents via certain negative values of crom_buf->len in an FW_GCROM command. NOTE: this issue has been labeled as an integer overflow, but it is more like an integer signedness error.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
19 references
Date Public
2006-11-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:12:31.364Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20061116 Re: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/451861/100/0/threaded"
},
{
"name": "1017344",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017344"
},
{
"name": "20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0261.html"
},
{
"name": "20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/451637/100/0/threaded"
},
{
"name": "[tech-security] 20061116 Re: [Full-disclosure] NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://mail-index.netbsd.org/tech-security/2006/11/16/0001.html"
},
{
"name": "FreeBSD-SA-06:25",
"tags": [
"vendor-advisory",
"x_refsource_FREEBSD",
"x_transferred"
],
"url": "http://security.freebsd.org/advisories/FreeBSD-SA-06:25.kmem.asc"
},
{
"name": "freebsd-fwdev-integer-overflow(30347)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30347"
},
{
"name": "20061121 Clarifying integer overflows vs. signedness errors",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/452264/100/0/threaded"
},
{
"name": "20061122 Re: Clarifying integer overflows vs. signedness errors",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/452331/100/0/threaded"
},
{
"name": "20061120 RE: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/452124/100/0/threaded"
},
{
"name": "[tech-security] 20061214 NetBSD Security Note 20061214-1: Kernel memory leakage in firewire interface",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://mail-index.netbsd.org/tech-security/2006/12/14/0002.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.dragonflybsd.org/cvsweb/src/sys/bus/firewire/fwdev.c"
},
{
"name": "21089",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/21089"
},
{
"name": "22917",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/22917"
},
{
"name": "20061115 TrustedBSD* all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/451698/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/ieee1394/fwdev.c"
},
{
"name": "20061115 DragonFlyBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/451677/100/0/threaded"
},
{
"name": "20061115 FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/451629/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.kernelhacking.com/bsdadv1.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows local users to read arbitrary memory contents via certain negative values of crom_buf-\u003elen in an FW_GCROM command. NOTE: this issue has been labeled as an integer overflow, but it is more like an integer signedness error."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T20:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20061116 Re: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/451861/100/0/threaded"
},
{
"name": "1017344",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017344"
},
{
"name": "20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0261.html"
},
{
"name": "20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/451637/100/0/threaded"
},
{
"name": "[tech-security] 20061116 Re: [Full-disclosure] NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://mail-index.netbsd.org/tech-security/2006/11/16/0001.html"
},
{
"name": "FreeBSD-SA-06:25",
"tags": [
"vendor-advisory",
"x_refsource_FREEBSD"
],
"url": "http://security.freebsd.org/advisories/FreeBSD-SA-06:25.kmem.asc"
},
{
"name": "freebsd-fwdev-integer-overflow(30347)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30347"
},
{
"name": "20061121 Clarifying integer overflows vs. signedness errors",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/452264/100/0/threaded"
},
{
"name": "20061122 Re: Clarifying integer overflows vs. signedness errors",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/452331/100/0/threaded"
},
{
"name": "20061120 RE: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/452124/100/0/threaded"
},
{
"name": "[tech-security] 20061214 NetBSD Security Note 20061214-1: Kernel memory leakage in firewire interface",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://mail-index.netbsd.org/tech-security/2006/12/14/0002.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.dragonflybsd.org/cvsweb/src/sys/bus/firewire/fwdev.c"
},
{
"name": "21089",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/21089"
},
{
"name": "22917",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/22917"
},
{
"name": "20061115 TrustedBSD* all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/451698/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/ieee1394/fwdev.c"
},
{
"name": "20061115 DragonFlyBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/451677/100/0/threaded"
},
{
"name": "20061115 FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/451629/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.kernelhacking.com/bsdadv1.txt"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6013",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows local users to read arbitrary memory contents via certain negative values of crom_buf-\u003elen in an FW_GCROM command. NOTE: this issue has been labeled as an integer overflow, but it is more like an integer signedness error."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20061116 Re: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/451861/100/0/threaded"
},
{
"name": "1017344",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017344"
},
{
"name": "20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0261.html"
},
{
"name": "20061115 NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/451637/100/0/threaded"
},
{
"name": "[tech-security] 20061116 Re: [Full-disclosure] NetBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "MLIST",
"url": "http://mail-index.netbsd.org/tech-security/2006/11/16/0001.html"
},
{
"name": "FreeBSD-SA-06:25",
"refsource": "FREEBSD",
"url": "http://security.freebsd.org/advisories/FreeBSD-SA-06:25.kmem.asc"
},
{
"name": "freebsd-fwdev-integer-overflow(30347)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30347"
},
{
"name": "20061121 Clarifying integer overflows vs. signedness errors",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/452264/100/0/threaded"
},
{
"name": "20061122 Re: Clarifying integer overflows vs. signedness errors",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/452331/100/0/threaded"
},
{
"name": "20061120 RE: FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/452124/100/0/threaded"
},
{
"name": "[tech-security] 20061214 NetBSD Security Note 20061214-1: Kernel memory leakage in firewire interface",
"refsource": "MLIST",
"url": "http://mail-index.netbsd.org/tech-security/2006/12/14/0002.html"
},
{
"name": "http://www.dragonflybsd.org/cvsweb/src/sys/bus/firewire/fwdev.c",
"refsource": "MISC",
"url": "http://www.dragonflybsd.org/cvsweb/src/sys/bus/firewire/fwdev.c"
},
{
"name": "21089",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/21089"
},
{
"name": "22917",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/22917"
},
{
"name": "20061115 TrustedBSD* all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/451698/100/0/threaded"
},
{
"name": "http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/ieee1394/fwdev.c",
"refsource": "CONFIRM",
"url": "http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/ieee1394/fwdev.c"
},
{
"name": "20061115 DragonFlyBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/451677/100/0/threaded"
},
{
"name": "20061115 FreeBSD all versions FireWire IOCTL kernel integer overflow information disclousure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/451629/100/0/threaded"
},
{
"name": "http://www.kernelhacking.com/bsdadv1.txt",
"refsource": "MISC",
"url": "http://www.kernelhacking.com/bsdadv1.txt"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6013",
"datePublished": "2006-11-21T23:00:00.000Z",
"dateReserved": "2006-11-21T00:00:00.000Z",
"dateUpdated": "2024-08-07T20:12:31.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}