NVD

Id
3971  
Name
CVE-2008-4113  
Description
The sctp_getsockopt_hmac_ident function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4, when the SCTP-AUTH extension is enabled, relies on an untrusted length value to limit copying of data from kernel memory, which allows local users to obtain sensitive information via a crafted SCTP_HMAC_IDENT IOCTL request involving the sctp_getsockopt function.  
Reject
 
CVSS Version
2  
CVSS Score
4.7  
Severity
Medium  
CVSS Base Score
4.7  
CVSS Impact Subscore
6.9  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:N/A:N)  
Pub Date
2017-01-03  
Published
2008-09-16  
Modified Date
2012-10-29  
Seq
2008-4113  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
25303 3971 CVE-2008-4113 http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git;a=commit;h=d97240552cd98c4b07322f30f66fd9c3ba4171de  View
25304 3971 CVE-2008-4113 SUSE-SA:2008:053  View
25305 3971 CVE-2008-4113 4266  View
25306 3971 CVE-2008-4113 DSA-1655  View
25307 3971 CVE-2008-4113 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.26.4  View
25308 3971 CVE-2008-4113 7618  View
25309 3971 CVE-2008-4113 [oss-security] 20080926 Re: CVE-2008-4113 update: kernel: sctp: fix random memory dereference with SCTP_HMAC_IDENT option  View
25310 3971 CVE-2008-4113 RHSA-2008:0857  View
25311 3971 CVE-2008-4113 20080911 [TKADV2008-007] Linux Kernel SCTP-AUTH API Information Disclosure Vulnerability and NULL Pointer Dereferences  View
25312 3971 CVE-2008-4113 31121  View
25313 3971 CVE-2008-4113 1021000  View
25314 3971 CVE-2008-4113 http://www.trapkit.de/advisories/TKADV2008-007.txt  View
25315 3971 CVE-2008-4113 USN-659-1  View
25316 3971 CVE-2008-4113 kernel-sctpgetsockopthmac-info-disclosure(45188)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
49551 JVNDB-2008-004861 Linux kernel の sctp 実装における重要な情報を取得される脆弱性 Linux kernel の Stream Control Transmission Protocol (sctp) 実装の net/sctp/socket.c の sctp_getsockopt_hmac_ident 関数は、SCTP-AUTH が有効になっている際、カーネルメモリからデータコピーを制限するにあたり信頼できないレングス値に依存するため、重要な情報を取得される脆弱性が存在します。 CVE-2008-4113 34226 CVE-2008-4113 3971 4.7 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-004861.html 2008-09-16 2012-09-25 View