NVD

Id
4268  
Name
CVE-2008-4445  
Description
The sctp_auth_ep_set_hmacs function in net/sctp/auth.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4, when the SCTP-AUTH extension is enabled, does not verify that the identifier index is within the bounds established by SCTP_AUTH_HMAC_ID_MAX, which allows local users to obtain sensitive information via a crafted SCTP_HMAC_IDENT IOCTL request involving the sctp_getsockopt function, a different vulnerability than CVE-2008-4113.  
Reject
 
CVSS Version
2  
CVSS Score
4.7  
Severity
Medium  
CVSS Base Score
4.7  
CVSS Impact Subscore
6.9  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:N/A:N)  
Pub Date
2017-01-03  
Published
2008-10-06  
Modified Date
2012-10-29  
Seq
2008-4445  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
27073 4268 CVE-2008-4445 http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git;a=commit;h=d97240552cd98c4b07322f30f66fd9c3ba4171de  View
27074 4268 CVE-2008-4445 SUSE-SA:2008:053  View
27075 4268 CVE-2008-4445 [linux-sctp] 20080827 [PATCH 0/2] sctp: additional overflow fixes  View
27076 4268 CVE-2008-4445 [linux-sctp] 20080827 [PATCH 2/2] sctp: fix random memory dereference with SCTP_HMAC_IDENT option.  View
27077 4268 CVE-2008-4445 DSA-1655  View
27078 4268 CVE-2008-4445 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.26.4  View
27079 4268 CVE-2008-4445 MDVSA-2008:223  View
27080 4268 CVE-2008-4445 [oss-security] 20080925 CVE-2008-4113 update: kernel: sctp: fix random memory dereference with SCTP_HMAC_IDENT option  View
27081 4268 CVE-2008-4445 [oss-security] 20080926 Re: CVE-2008-4113 update: kernel: sctp: fix random memory dereference with SCTP_HMAC_IDENT option  View
27082 4268 CVE-2008-4445 [oss-security] 20080927 Re: CVE-2008-4113 update: kernel: sctp: fix random memory dereference with SCTP_HMAC_IDENT option  View
27083 4268 CVE-2008-4445 [oss-security] 20080929 Re: CVE-2008-4113 update: kernel: sctp: fix random memory dereference with SCTP_HMAC_IDENT option  View
27084 4268 CVE-2008-4445 RHSA-2008:0857  View
27085 4268 CVE-2008-4445 31121  View
27086 4268 CVE-2008-4445 1021001  View
27087 4268 CVE-2008-4445 USN-659-1  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
49617 JVNDB-2008-004927 Linux kernel の sctp 実装における重要な情報を取得される脆弱性 Linux kernel の Stream Control Transmission Protocol (sctp) 実装の net/sctp/auth.c の sctp_auth_ep_set_hmacs 関数は、SCTP-AUTH 拡張が有効になっている際、SCTP_AUTH_HMAC_ID_MAX が確立した範囲内に識別子インデックスがあることを検証しない、および sctp_getsockopt 関数に関する処理に不備があるため、重要な情報を取得される脆弱性が存在します。 CVE-2008-4445 34558 CVE-2008-4445 4268 4.7 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-004927.html 2008-10-06 2012-09-25 View