National Cyber-Alert System

Vulnerability Summary for CVE-2006-0454

Overview

Linux kernel before 2.6.15.3 down to 2.6.12, while constructing an ICMP response in icmp_send, does not properly handle when the ip_options_echo function in icmp.c fails, which allows remote attackers to cause a denial of service (crash) via vectors such as (1) record-route and (2) timestamp IP options with the needaddr bit set and a truncated value.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (09/17/2006)

Not vulnerable. This vulnerability was introduced into the Linux kernel in version 2.6.12 and therefore does not affect users of Red Hat Enterprise Linux 2.1, 3, or 4.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 16532

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/16532

External Source: FEDORA

Name: FLSA:157459-4

Type: Advisory; Patch Information

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/427981/100/0/threaded

External Source: FEDORA

Name: FEDORA-2006-102

Type: Advisory; Patch Information

Hyperlink:http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00037.html

External Source: SUSE

Name: SUSE-SA:2006:006

Type: Advisory; Patch Information

Hyperlink:http://www.novell.com/linux/security/advisories/2006_06_kernel.html

External Source: VUPEN

Name: ADV-2006-0464

Type: Advisory; Patch Information

Hyperlink:http://www.frsirt.com/english/advisories/2006/0464

External Source: SECUNIA

Name: 18861

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/18861

External Source: SECUNIA

Name: 18788

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/18788

External Source: SECUNIA

Name: 18784

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/18784

External Source: SECUNIA

Name: 18774

Type: Patch Information

Hyperlink:http://secunia.com/advisories/18774

External Source: SECUNIA

Name: 18766

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/18766

External Source: MLIST

Name: [dailydave] 20060207 Fun with Linux (2.6.12 -> 2.6.15.2)

Type: Patch Information

Hyperlink:http://lists.immunitysec.com/pipermail/dailydave/2006-February/002909.html

External Source: UBUNTU

Name: USN-250-1

Hyperlink:http://www.ubuntu.com/usn/usn-250-1

External Source: TRUSTIX

Name: 2006-0006

Type: Advisory

Hyperlink:http://www.trustix.org/errata/2006/0006

External Source: CONFIRM

Name: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.3

Hyperlink:http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.3

External Source: MLIST

Name: [linux-kernel] 20060207 Re: Linux 2.6.15.3

Hyperlink:http://marc.theaimsgroup.com/?l=linux-kernel&m=113927648820694&w=2

External Source: MLIST

Name: [linux-kernel] 20060207 Linux 2.6.15.3

Hyperlink:http://marc.theaimsgroup.com/?l=linux-kernel&m=113927617401569&w=2

External Source: MANDRIVA

Name: MDKSA-2006:040

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:040

External Source: XF

Name: kernel-icmp-ipoptionsecho-dos(24575)

Hyperlink:http://xforce.iss.net/xforce/xfdb/24575

External Source: MANDRIVA

Name: MDKSA-2006:040

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:040