CVE-2008-4609
At a glance
- Source
- NVD
- EPSS
- EPSS 32.12 % · percentile 98 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
Weaknesses (CWE)
References
- http://blog.robertlee.name/2008/10/conjecture-speculation.html
- https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html
- http://marc.info/?l=bugtraq&m=125856010926699&w=2
- http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html
- http://insecure.org/stf/tcp-dos-attack-explained.html
- http://www.outpost24.com/news/news-2008-10-02.html
- http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml
- http://www.us-cert.gov/cas/techalerts/TA09-251A.html
- http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
- http://www.cisco.com/en/US/products/products_security_response09186a0080a15120.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048
- http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6340
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | HIGH 7.1 | AV:N/AC:M/Au:N/C:N/I:N/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2008-4589
- GCVE · GCVE-0-2008-4609
CERT-FR advisories
- CERTFR-2021-AVI-669 — Multiples vulnérabilités dans les produits Moxa · cert.ssi.gouv.fr
- CERTA-2012-AVI-393 — Multiples vulnérabilités dans les produits Oracle · cert.ssi.gouv.fr
- CERTA-2009-AVI-422 — Vulnérabilité dans Mc Afee Email and Web Security Appliance · cert.ssi.gouv.fr
- CERTA-2009-AVI-377 — Vulnérabilités des produits Cisco · cert.ssi.gouv.fr
- CERTA-2009-AVI-376 — Vulnérabilité dans les produits Check Point · cert.ssi.gouv.fr
- CERTA-2009-AVI-372 — Multiples vulnérabilités dans TCP/IP sous Windows · cert.ssi.gouv.fr
- CERTA-2009-ALE-017 — Vulnérabilités dans l'implémentation TCP/IP de divers produits · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:bsd:bsd:-:*:*:*:*:*:*:*cpe:2.3:o:bsd:bsd:4.1:*:*:*:*:*:*:*cpe:2.3:o:bsd:bsd:4.2:*:*:*:*:*:*:*cpe:2.3:o:bsd:bsd:4.3:*:*:*:*:*:*:*cpe:2.3:o:bsd:bsd:4.4:*:*:*:*:*:*:*cpe:2.3:o:bsdi:bsd_os:-:*:*:*:*:*:*:*cpe:2.3:o:bsdi:bsd_os:1.1:*:*:*:*:*:*:*cpe:2.3:o:bsdi:bsd_os:2.0:*:*:*:*:*:*:*cpe:2.3:o:bsdi:bsd_os:2.0.1:*:*:*:*:*:*:*cpe:2.3:o:bsdi:bsd_os:2.1:*:*:*:*:*:*:*cpe:2.3:o:bsdi:bsd_os:3.0:*:*:*:*:*:*:*cpe:2.3:o:bsdi:bsd_os:3.1:*:*:*:*:*:*:*cpe:2.3:o:bsdi:bsd_os:3.2:*:*:*:*:*:*:*cpe:2.3:o:bsdi:bsd_os:4.0:*:*:*:*:*:*:*cpe:2.3:o:bsdi:bsd_os:4.0.1:*:*:*:*:*:*:*cpe:2.3:o:bsdi:bsd_os:4.1:*:*:*:*:*:*:*cpe:2.3:o:bsdi:bsd_os:4.2:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:-:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:4.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:4.1.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:4.1.2:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:8.2:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:8.3:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:9.0:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:9.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:9.14:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:10.0:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:10.3:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:10.3\(3.3\):*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:10.3\(3.4\):*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:10.3\(4.2\):*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:10.3\(4.3\):*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:10.3\(16\):*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:10.3\(19a\):*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:11:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:11.0:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:11.0\(12\):*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:11.0\(17\):*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:11.0\(17\)bt:*:*:*:*:*:*:*cpe:2.3:o:cisco:ios:11.0\(18\):*:*:*:*:*:*:*- +2006 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |