Sun Solaris Remote IPv6 IPSec Packet Denial of Service Vulnerability

Bugtraq ID:	24473
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2007-3248
Remote:	Yes
Local:	No
Published:	Jun 14 2007 12:00AM
Updated:	Jul 03 2007 10:18PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Sun Solaris 10_x86 Sun Solaris 10 Avaya Interactive Response 2.0
Not Vulnerable:

Sun Solaris Remote IPv6 IPSec Packet Denial of Service Vulnerability

Sun Solaris is prone to a denial-of-service vulnerability because the operating system fails to handle exceptional conditions.

An attacker can exploit this issue to cause the affected kernel to panic, resulting in a denial-of-service condition.

This issue affects the Solaris 10 operating system.

Sun Solaris Remote IPv6 IPSec Packet Denial of Service Vulnerability

To exploit this issue, attackers use readily available packet generators.

Sun Solaris Remote IPv6 IPSec Packet Denial of Service Vulnerability

Solution:
Sun has released patches and an advisory to address this issue. Please see the references for more information.


Sun Solaris 10

• Sun 125100-09
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-125100-09-1

Sun Solaris 10_x86

• Sun 125101-09
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-125101-09-1

Sun Solaris Remote IPv6 IPSec Packet Denial of Service Vulnerability

References:

• Solaris Homepage (Sun Microsystems)
  
• ASA-2007-275 Security Vulnerability in IPv6 Implementation (ip6(7p)) Related to (Avaya)
  
• Sun Alert ID: 102919 (Sun)