Spoofed Kernel Netlink Interface Message Denial of Service Vulnerability
BID:9027
Info
Spoofed Kernel Netlink Interface Message Denial of Service Vulnerability
| Bugtraq ID: | 9027 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2003-0859 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 12 2003 12:00AM |
| Updated: | Jul 12 2009 12:56AM |
| Credit: | The discovery of this vulnerability has been credited to Herbert Xu. |
| Vulnerable: |
SGI ProPack 2.3 SGI ProPack 2.2.1 Redhat Enterprise Linux WS 2.1 IA64 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux ES 2.1 IA64 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux AS 2.1 IA64 Redhat Enterprise Linux AS 2.1 Redhat Advanced Workstation for the Itanium Processor 2.1 Quagga Quagga Routing Software Suite 0.96.2 GNU Zebra 0.93 b GNU Zebra 0.93 a GNU Zebra 0.92 a GNU Zebra 0.91 a GNU glibc 2.3.2 GNU glibc 2.2.4 |
| Not Vulnerable: | |
Discussion
Spoofed Kernel Netlink Interface Message Denial of Service Vulnerability
Applications which make use of the kernel Netlink interface are said to be prone to denial of service attacks.
It has been reported that applications implementing the getifaddrs() glibc function may be prone to denial of service attacks. The problem is said to occur due to the way getifaddrs() interacts with the netlink device. Under some circumstances, an anonymous netlink message handled by the getifaddrs() function may cause the application to crash.
Red Hat has stated that GNU Zebra, Quagga and iproute are also affected by this vulnerability due to the way they interact with the netlink interface; exploitation may result in a denial of service.
The precise technical details regarding this issue are currently unknown. This BID will be updated, as further information is made available.
Applications which make use of the kernel Netlink interface are said to be prone to denial of service attacks.
It has been reported that applications implementing the getifaddrs() glibc function may be prone to denial of service attacks. The problem is said to occur due to the way getifaddrs() interacts with the netlink device. Under some circumstances, an anonymous netlink message handled by the getifaddrs() function may cause the application to crash.
Red Hat has stated that GNU Zebra, Quagga and iproute are also affected by this vulnerability due to the way they interact with the netlink interface; exploitation may result in a denial of service.
The precise technical details regarding this issue are currently unknown. This BID will be updated, as further information is made available.
Exploit / POC
Spoofed Kernel Netlink Interface Message Denial of Service Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Spoofed Kernel Netlink Interface Message Denial of Service Vulnerability
Solution:
OpenPKG has released advisory (OpenPKG-SA-2003.049) to address this issue. Users are advised to apply relative patches as soon as possible. Further information, including patch information, can be found in the attached advisory. Fixes are linked below.
Red Hat has released a security advisory (RHSA-2003:325-01) containing fixes to address this and a separate issue. Users are advised to upgrade as soon as possible. Further information can be found in the attached advisory.
*** November 13, 2003 - An updated versions of the above advisory has been released containing revised fixes for Red Hat 9. Users are advised to upgrade to the latest fixes.
Red Hat has released advisory RHSA-2003:305-12 to address this issue in their Linux Enterprise software. Relevant patches are available through the Red Hat Network. See the referenced advisory for additional details.
Red Hat has released advisory RHSA-2003:317-08 to address this issue in their Linux Enterprise software. Relevant patches are available through the Red Hat Network. See the referenced advisory for additional details.
Red Hat has released advisory RHSA-2003:307-01 to address this issue in their Linux Enterprise software. Users are advised to upgrade as soon as possible. Further information, including patch information, can be found in the attached advisory.
Red Hat has released advisory RHSA-2003:315-08 to address this issue in their Linux Enterprise software. Relevant patches are available through the Red Hat Network. See the referenced advisory for additional details.
SGI has released an advisory (20031101-01-U) pertaining to their ProPack Linux distribution. The advisory has been released in response to a number of RHSA advisories, and includes a patch (Patch 10032) containing updated RPM packages relating to a number of different BIDS. These RPMs address both the Zebra and Iproute packages detailed in this BID.
Patch 10032 can be obtained via the following link:
http://support.sgi.com/
For information regarding how to obtain individual RPM packages included in Patch 10032, please see the attached advisory.
Conectiva has released an advisory that includes updates for this issue. Conectiva also released an advisory for Conectiva Linux Enterprise Edition with fixes.
TurboLinux has released an advisory, and made fixes for this issue available. Affected users are advised to execute one of the following commands:
# turbopkg
OR
# zabom update glibc glibc-devel glibc-profile mtrace nscd
Additional TurboLinux information is available in the referenced advisory.
Sun has released a fix for Sun Linux 5.0.7.
Debian has issued fixes and an advisory for zebra.
Fixes:
GNU Zebra 0.91 a
GNU Zebra 0.92 a
GNU Zebra 0.93 b
GNU glibc 2.2.4
GNU glibc 2.3.2
Solution:
OpenPKG has released advisory (OpenPKG-SA-2003.049) to address this issue. Users are advised to apply relative patches as soon as possible. Further information, including patch information, can be found in the attached advisory. Fixes are linked below.
Red Hat has released a security advisory (RHSA-2003:325-01) containing fixes to address this and a separate issue. Users are advised to upgrade as soon as possible. Further information can be found in the attached advisory.
*** November 13, 2003 - An updated versions of the above advisory has been released containing revised fixes for Red Hat 9. Users are advised to upgrade to the latest fixes.
Red Hat has released advisory RHSA-2003:305-12 to address this issue in their Linux Enterprise software. Relevant patches are available through the Red Hat Network. See the referenced advisory for additional details.
Red Hat has released advisory RHSA-2003:317-08 to address this issue in their Linux Enterprise software. Relevant patches are available through the Red Hat Network. See the referenced advisory for additional details.
Red Hat has released advisory RHSA-2003:307-01 to address this issue in their Linux Enterprise software. Users are advised to upgrade as soon as possible. Further information, including patch information, can be found in the attached advisory.
Red Hat has released advisory RHSA-2003:315-08 to address this issue in their Linux Enterprise software. Relevant patches are available through the Red Hat Network. See the referenced advisory for additional details.
SGI has released an advisory (20031101-01-U) pertaining to their ProPack Linux distribution. The advisory has been released in response to a number of RHSA advisories, and includes a patch (Patch 10032) containing updated RPM packages relating to a number of different BIDS. These RPMs address both the Zebra and Iproute packages detailed in this BID.
Patch 10032 can be obtained via the following link:
http://support.sgi.com/
For information regarding how to obtain individual RPM packages included in Patch 10032, please see the attached advisory.
Conectiva has released an advisory that includes updates for this issue. Conectiva also released an advisory for Conectiva Linux Enterprise Edition with fixes.
TurboLinux has released an advisory, and made fixes for this issue available. Affected users are advised to execute one of the following commands:
# turbopkg
OR
# zabom update glibc glibc-devel glibc-profile mtrace nscd
Additional TurboLinux information is available in the referenced advisory.
Sun has released a fix for Sun Linux 5.0.7.
Debian has issued fixes and an advisory for zebra.
Fixes:
GNU Zebra 0.91 a
-
Sun zebra-0.91a-8.7.2.i386.rpm
ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/zebra-0.91a-8.7.2.i386.rpm
GNU Zebra 0.92 a
-
Debian zebra-doc_0.92a-5woody2_all.deb
http://security.debian.org/pool/updates/main/z/zebra/zebra-doc_0.92a-5 woody2_all.deb -
Debian zebra_0.92a-5woody2_alpha.deb
http://security.debian.org/pool/updates/main/z/zebra/zebra_0.92a-5wood y2_alpha.deb -
Debian zebra_0.92a-5woody2_arm.deb
http://security.debian.org/pool/updates/main/z/zebra/zebra_0.92a-5wood y2_arm.deb -
Debian zebra_0.92a-5woody2_hppa.deb
http://security.debian.org/pool/updates/main/z/zebra/zebra_0.92a-5wood y2_hppa.deb -
Debian zebra_0.92a-5woody2_i386.deb
http://security.debian.org/pool/updates/main/z/zebra/zebra_0.92a-5wood y2_i386.deb -
Debian zebra_0.92a-5woody2_ia64.deb
http://security.debian.org/pool/updates/main/z/zebra/zebra_0.92a-5wood y2_ia64.deb -
Debian zebra_0.92a-5woody2_m68k.deb
http://security.debian.org/pool/updates/main/z/zebra/zebra_0.92a-5wood y2_m68k.deb -
Debian zebra_0.92a-5woody2_mips.deb
http://security.debian.org/pool/updates/main/z/zebra/zebra_0.92a-5wood y2_mips.deb -
Debian zebra_0.92a-5woody2_mipsel.deb
http://security.debian.org/pool/updates/main/z/zebra/zebra_0.92a-5wood y2_mipsel.deb -
Debian zebra_0.92a-5woody2_powerpc.deb
http://security.debian.org/pool/updates/main/z/zebra/zebra_0.92a-5wood y2_powerpc.deb -
Debian zebra_0.92a-5woody2_s390.deb
http://security.debian.org/pool/updates/main/z/zebra/zebra_0.92a-5wood y2_s390.deb -
Debian zebra_0.92a-5woody2_sparc.deb
http://security.debian.org/pool/updates/main/z/zebra/zebra_0.92a-5wood y2_sparc.deb
GNU Zebra 0.93 b
-
Conectiva zebra-0.93b-149.i586.rpm
ftp://ul.conectiva.com.br/updates/1.0/RPMS.core/zebra-0.93b-149.i586.r pm -
OpenPKG zebra-0.93b-1.2.1.src.rpm
ftp://ftp.openpkg.org/release/1.2/UPD/zebra-0.93b-1.2.1.src.rpm -
OpenPKG zebra-0.93b-1.3.1.src.rpm
ftp://ftp.openpkg.org/release/1.3/UPD/zebra-0.93b-1.3.1.src.rpm
GNU glibc 2.2.4
-
TurboLinux glibc-2.2.4-13.i586.rpm
ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updat es/RPMS/glibc-2.2.4-13.i586.rpm -
TurboLinux glibc-devel-2.2.4-13.i586.rpm
ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updat es/RPMS/glibc-devel-2.2.4-13.i586.rpm -
TurboLinux glibc-profile-2.2.4-13.i586.rpm
ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updat es/RPMS/glibc-profile-2.2.4-13.i586.rpm -
TurboLinux mtrace-2.2.4-13.i586.rpm
ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updat es/RPMS/mtrace-2.2.4-13.i586.rpm -
TurboLinux nscd-2.2.4-13.i586.rpm
ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updat es/RPMS/nscd-2.2.4-13.i586.rpm
GNU glibc 2.3.2
-
Red Hat glibc-2.3.2-27.9.6.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-2.3.2-27.9.6.i386.rpm -
Red Hat glibc-2.3.2-27.9.6.i686.rpm
ftp://updates.redhat.com/9/en/os/i686/glibc-2.3.2-27.9.6.i686.rpm -
Red Hat glibc-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-2.3.2-27.9.7.i386.rpm -
Red Hat glibc-2.3.2-27.9.7.i686.rpm
ftp://updates.redhat.com/9/en/os/i686/glibc-2.3.2-27.9.7.i686.rpm -
Red Hat glibc-common-2.3.2-27.9.6.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-common-2.3.2-27.9.6.i386.r pm -
Red Hat glibc-common-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-common-2.3.2-27.9.7.i386.r pm -
Red Hat glibc-debug-2.3.2-27.9.6.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-debug-2.3.2-27.9.6.i386.rp m -
Red Hat glibc-debug-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-debug-2.3.2-27.9.7.i386.rp m -
Red Hat glibc-devel-2.3.2-27.9.6.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-devel-2.3.2-27.9.6.i386.rp m -
Red Hat glibc-devel-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-devel-2.3.2-27.9.7.i386.rp m -
Red Hat glibc-profile-2.3.2-27.9.6.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-profile-2.3.2-27.9.6.i386. rpm -
Red Hat glibc-profile-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-profile-2.3.2-27.9.7.i386. rpm -
Red Hat glibc-utils-2.3.2-27.9.6.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-utils-2.3.2-27.9.6.i386.rp m -
Red Hat glibc-utils-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-utils-2.3.2-27.9.7.i386.rp m -
Red Hat nptl-devel-2.3.2-27.9.6.i686.rpm
ftp://updates.redhat.com/9/en/os/i686/nptl-devel-2.3.2-27.9.6.i686.rpm -
Red Hat nptl-devel-2.3.2-27.9.7.i686.rpm
ftp://updates.redhat.com/9/en/os/i686/nptl-devel-2.3.2-27.9.7.i686.rpm -
Red Hat nscd-2.3.2-27.9.6.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/nscd-2.3.2-27.9.6.i386.rpm -
Red Hat nscd-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/nscd-2.3.2-27.9.7.i386.rpm
References
Spoofed Kernel Netlink Interface Message Denial of Service Vulnerability
References:
References:
- CLSA-2003:789 zebra (Conectiva)
- DSA-415-1 (Debian)
- Quagga Software Suite Homepage (Quagga)
- RHSA-2003-315 Updated quagga packages fix local security vulnerability (Red Hat)
- RHSA-2003-317 - Updated iproute packages fix local security vulnerability (Red Hat )
- RHSA-2003:305-12 Updated zebra packages fix security vulnerabilities (RedHat)