Linux Kernel IPv6 Hop-By-Hop Header Remote Denial of Service Vulnerability

Bugtraq ID:	26943
Class:	Input Validation Error
CVE:	CVE-2007-4567
Remote:	Yes
Local:	No
Published:	Dec 19 2007 12:00AM
Updated:	May 28 2010 11:20AM
Credit:	Eric Sesterhenn and Victor Julien are credited with discovering this issue.
Vulnerable:	VMWare vMA 4.0 RHEL5 VMWare ESX Server 4.0 ESX400-201003405 VMWare ESX Server 4.0 ESX400-200912403 VMWare ESX Server 4.0 ESX400-200909401 VMWare ESX Server 4.0 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Redhat Enterprise Virtualization Hypervisor 2.1 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5.3.z server Redhat Enterprise Linux 5.2.z server Redhat Enterprise Linux 5 Server Linux kernel 2.6.22
Not Vulnerable:	VMWare ESX Server 4.0 ESX400-201005401 Linux kernel 2.6.22-rc1

Linux Kernel IPv6 Hop-By-Hop Header Remote Denial of Service Vulnerability

The Linux kernel is prone to a remote denial-of-service vulnerability because it fails to adequately validate specially crafted IPv6 'Hop-By-Hop' headers.

Attackers can exploit this issue to cause a kernel panic, denying service to legitimate users.

Linux Kernel IPv6 Hop-By-Hop Header Remote Denial of Service Vulnerability

Attackers can use readily available networking tools to exploit this issue.

The following exploit code is available:

• /data/vulnerabilities/exploits/26943.c

Linux Kernel IPv6 Hop-By-Hop Header Remote Denial of Service Vulnerability

References:

• Linux 2.6.22-rc1 Changelog (Kernel.org)
  
• Ubuntu Homepage (Ubuntu)