BID:8689

BSD Kernel ARP Cache Flooding Denial of Service Vulnerability

Info

BSD Kernel ARP Cache Flooding Denial of Service Vulnerability

Bugtraq ID:	8689
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2003-0804
Remote:	Yes
Local:	No
Published:	Sep 22 2003 12:00AM
Updated:	Jul 11 2009 11:56PM
Credit:	This vulnerability was announced by Apple.
Vulnerable:	SGI IRIX 6.5.22 m SGI IRIX 6.5.22 SGI IRIX 6.5.21 m SGI IRIX 6.5.21 f SGI IRIX 6.5.21 SGI IRIX 6.5.20 m SGI IRIX 6.5.20 f SGI IRIX 6.5.20 SGI IRIX 6.5.19 m SGI IRIX 6.5.19 f SGI IRIX 6.5.19 SGI IRIX 6.5.18 m SGI IRIX 6.5.18 f SGI IRIX 6.5.18 SGI IRIX 6.5.17 m SGI IRIX 6.5.17 f SGI IRIX 6.5.17 SGI IRIX 6.5.16 m SGI IRIX 6.5.16 f SGI IRIX 6.5.16 SGI IRIX 6.5.15 m SGI IRIX 6.5.15 f SGI IRIX 6.5.15 SGI IRIX 6.5.14 m SGI IRIX 6.5.14 f SGI IRIX 6.5.14 SGI IRIX 6.5.13 m SGI IRIX 6.5.13 f SGI IRIX 6.5.13 SGI IRIX 6.5.12 m SGI IRIX 6.5.12 f SGI IRIX 6.5.12 SGI IRIX 6.5.11 m SGI IRIX 6.5.11 f SGI IRIX 6.5.11 SGI IRIX 6.5.10 m SGI IRIX 6.5.10 f SGI IRIX 6.5.10 SGI IRIX 6.5.9 m SGI IRIX 6.5.9 f SGI IRIX 6.5.9 SGI IRIX 6.5.8 m SGI IRIX 6.5.8 f SGI IRIX 6.5.8 SGI IRIX 6.5.7 m SGI IRIX 6.5.7 f SGI IRIX 6.5.7 SGI IRIX 6.5.6 m SGI IRIX 6.5.6 f SGI IRIX 6.5.6 SGI IRIX 6.5.5 m SGI IRIX 6.5.5 f SGI IRIX 6.5.5 SGI IRIX 6.5.4 m SGI IRIX 6.5.4 f SGI IRIX 6.5.4 SGI IRIX 6.5.3 m SGI IRIX 6.5.3 f SGI IRIX 6.5.3 SGI IRIX 6.5.2 m SGI IRIX 6.5.2 f SGI IRIX 6.5.2 SGI IRIX 6.5.1 SGI IRIX 6.5 20 SGI IRIX 6.5 .19m SGI IRIX 6.5 .19f SGI IRIX 6.5 OpenBSD OpenBSD 3.4 OpenBSD OpenBSD 3.3 OpenBSD OpenBSD 3.2 FreeBSD FreeBSD 5.1 FreeBSD FreeBSD 5.0 FreeBSD FreeBSD 4.9 -PRERELEASE FreeBSD FreeBSD 4.8 FreeBSD FreeBSD 4.7 FreeBSD FreeBSD 4.6.2 FreeBSD FreeBSD 4.6 FreeBSD FreeBSD 4.5 FreeBSD FreeBSD 4.4 FreeBSD FreeBSD 4.3 FreeBSD FreeBSD 4.2 FreeBSD FreeBSD 4.1.1 FreeBSD FreeBSD 4.1 FreeBSD FreeBSD 4.0 Apple Mac OS X Server 10.2.7 Apple Mac OS X Server 10.2.6 Apple Mac OS X Server 10.2.5 Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X 10.2.7 Apple Mac OS X 10.2.6 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2

Not Vulnerable:	SGI IRIX 6.5.23 Apple Mac OS X Server 10.2.8 Apple Mac OS X 10.2.8

Discussion

BSD Kernel ARP Cache Flooding Denial of Service Vulnerability

A vulnerability has been discovered in the BSD kernel. The problem occurs in the storage of ARP cache entries when handling ARP requests. As a result of this issue, an attacker capable of transmitted a large volume of spoofed ARP requests to a target system may be capable of triggering a system panic. This would effectively deny services to other legitimate users until the system is manually rebooted.

The issue is reported to exist in FreeBSD, IRIX and MacOS X. Other systems, which use a BSD-derived kernel, may also be prone to the issue.

Solution / Fix

BSD Kernel ARP Cache Flooding Denial of Service Vulnerability

Solution:
OpenBSD has acknowledged that this issue affects OpenBSD version 3.2 and 3.3. A patch is available to address this issue. The patches are linked below.

FreeBSD has addressed this issue in the latest RELENG releases. They have also issued a patch which is known to work with FreeBSD 5-CURRENT, 4-9-PRELEASE, and 4.8 systems. Users wishing to upgrade to the latest RELENG release can see the attached advisory for further details.

Apple has also released MacOS X 10.2.8 to address this issue. This update can be applied via the Software Update pane in System Preferences. Manual updates are available via the Apple Software Downloads site.

OpenBSD has issued a new patch for 3.4. At the time of writing, the patch is not available.

SGI has released an advisory (20050502-01-P) and patches to address this issue in SGI IRIX. Customers are advised to see the referenced advisory for further details regarding obtaining and applying appropriate patches.

OpenBSD OpenBSD 3.2