exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

LinuxSCTP2616.txt

LinuxSCTP2616.txt
Posted May 17, 2006
Authored by Mu Security research team | Site labs.musecurity.com

Multiple vulnerabilities exist in Linux SCTP 2.6.16 (lksctp) all resulting in kernel panics. The crafted packets must be sent to a listening endpoint in order to exploit these vulnerabilities.

tags | advisory, kernel, vulnerability
systems | linux
SHA-256 | 5e0aff6ee62b8c5cbca65ce839330a6b9fde0b8a7294f3986963b2e02876e08e

LinuxSCTP2616.txt

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Multiple vulnerabilities in Linux SCTP 2.6.16 [MU-200605-01]
May 8, 2006

http://labs.musecurity.com/advisories.html

Affected Product/Versions:

Linux SCTP 2.6.16 [http://lksctp.sourceforge.net]

Product Overview:

The Linux Kernel Stream Control Transmission Protocol (lksctp) project is an
implementation of the Stream Control Transmission Protocol (SCTP) in the Linux
kernel. The primary goal of this project is to provide user applications with
a viable SCTP solution.

Vulnerability Details:

Multiple vulnerabilities exist in Linux SCTP 2.6.16 (lksctp) all resulting in
kernel panics. The crafted packets must be sent to a listening endpoint in
order to exploit these vulnerabilities.

The first vulnerablity triggered by ECNE chunks is due to the use of incorrect
state table entries for certain CHUNKS received in CLOSED state. Since this
vulnerability does not require a full 'session' to be established, the source
IP address may be spoofed resulting in a single packet triggering the panic.

The second vulnerability is triggered due to a bug in handling incoming IP
fragmented SCTP control chunks. This causes a kernel BUG in skb_pull.

Vendor Response / Solution:

All users of Linux SCTP are recommended to upgrade to 2.6.17 which fixes
these problems.

Hotfix solution to this advisory:

Patches for these two vulnerabilities are available from the following links:

http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=35d63edb1c807bc5317e49592260e84637bc432e
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=62b08083ec3dbfd7e533c8d230dd1d8191a6e813

Mu Security would like to thank the Linux SCTP team in advance for timely
remediation of these vulnerabilities.

Credit:

This vulnerability was discovered by the Mu Security research team.

http://labs.musecurity.com/pgpkey.txt

Mu Security is an early-stage innovator creating a new class of security
analysis system. The company's mission is to widely deploy security analysis
and reduce product and application vulnerabilities. Mu's founders include
industry-recognized experts in the IDP, open source protocol analysis tools,
ethical hacking, and network management markets. The security analysis process
and product solution provide a rigorous and streamlined methodology for
verifying and improving the security readiness of any IP-based product or
application. Mu Security, headquartered in Sunnyvale, California, is backed
by preeminent venture capital firms including Accel Partners and Benchmark
Capital.

The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There are no
warranties, implied or express, with regard to this information. In no event
shall the author be liable for any direct or indirect damages whatsoever
arising out of or in connection with the use or spread of this information.
Any use of this information is at the user's own risk.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (Darwin)

iD8DBQFEX48vMl+docYeP+YRAnwtAJ955MaoL9VqEZf2rii77pwvxFdW0wCfUnGY
zvQs8yldRZLPzef9D9JyR4Y=
=WO2x
-----END PGP SIGNATURE-----

Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close