OpenBSD 'tcp_respond()' Remote Denial of Service Vulnerability

Bugtraq ID:	27949
Class:	Design Error
CVE:	CVE-2008-1058
Remote:	Yes
Local:	No
Published:	Feb 22 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	The vendor disclosed this issue.
Vulnerable:	OpenBSD OpenBSD 4.2
Not Vulnerable:

OpenBSD 'tcp_respond()' Remote Denial of Service Vulnerability

OpenBSD is prone to a remote denial-of-service vulnerability because of a flaw in the affected kernel when processing certain TCP packets.

Exploiting this issue allows remote attackers to trigger kernel panics, denying further service to legitimate users.

OpenBSD 4.2 is vulnerable to this issue; other versions may also be affected.

OpenBSD 'tcp_respond()' Remote Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenBSD 'tcp_respond()' Remote Denial of Service Vulnerability

Solution:
Fixes have been committed to OpenBSD's CVS repository, and patches are available for OpenBSD 4.2. Please see the references for more information.


OpenBSD OpenBSD 4.2

• OpenBSD 007_tcprespond.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/007_tcprespond.pa tch

OpenBSD 'tcp_respond()' Remote Denial of Service Vulnerability

References:

• 007: RELIABILITY FIX: February 22, 2008 (OpenBSD)
  
• OpenBSD Errata Page (OpenBSD)
  
• OpenBSD Homepage (OpenBSD)