search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Linux Kernel may fail to properly handle SNMP packets

Vulnerability Note VU#681569

Original Release Date: 2006-06-09 | Last Revised: 2006-07-13

Overview

A memory freeing vulnerability in the Linux kernel module ip_nat_snmp_basic can be exploited to create a denial-of-service condition.

Description

ip_nat_snmp_basic

The ip_nat_snmp_basic IP NAT module is intended for use with SNMP network discovery and monitoring applications where target networks use conflicting private IP addresses .

snmp_trap_decode()

The snmp_trap_decode()function decodes v1 and v2 SNMP messages.

The Problem

The function snmp_trap_decode() in the Linux kernel module ip_nat_snmp_basic fails to properly free memory when handling certain SNMP packets.

Impact

A remote attacker could cause a system running Linux kernel version < 2.6.16.18 with the ip_nat_snmp_basic module loaded to crash. This results in a denial-of-service condition.

Solution

Apply an update
See the systems affected section of this document for information about specific vendors. Users who compile the Linux kernel from source are encouraged to upgrade to Linux kernel version 2.6.16.18.


Do not use ip_nat_snmp_basic

Do not load the ip_nat_snmp_basic kernel module if it is not needed.

Restrict Access

Limit access to SNMP ports (default 161/udp and 162/udp) to trusted hosts.

Vendor Information

681569
Expand all

Mandriva, Inc.

Updated:  June 09, 2006

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Mandriva, Inc. has published Mandriva Linux Security Advisory MDKSA-2006:087 in response to this issue. Users are encouraged to review this advisory and apply the patches it refers to.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Trustix Secure Linux

Updated:  June 09, 2006

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Trustix has published Trustix Secure Linux Security Advisory #2006-0030 in response to this issue. Users are encouraged to review this advisory and apply the patches it refers to.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

This vuln erability was reported by Patrick McHardy

This document was written by Ryan Giobbi.

Other Information

CVE IDs: CVE-2006-2444
Severity Metric: 2.69
Date Public: 2006-05-23
Date First Published: 2006-06-09
Date Last Updated: 2006-07-13 20:42 UTC
Document Revision: 21

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.