VAR-200809-0196
Vulnerability from variot - Updated: 2023-12-18 10:44NetBSD 3.0, 3.1, and 4.0, when a pppoe instance exists, does not properly check the length of a PPPoE packet tag, which allows remote attackers to cause a denial of service (system crash) via a crafted PPPoE packet. NetBSD is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to crash the affected computer, denying service to legitimate users. Given the nature of this issue, remote code execution may be possible, but this has not been confirmed. ----------------------------------------------------------------------
Want a new job?
http://secunia.com/secunia_security_specialist/ http://secunia.com/hardcore_disassembler_and_reverse_engineer/
TITLE: NetBSD PPPoE Packet Processing Tag Length Vulnerability
SECUNIA ADVISORY ID: SA31597
VERIFY ADVISORY: http://secunia.com/advisories/31597/
CRITICAL: Less critical
IMPACT: DoS, System access
WHERE:
From local network
OPERATING SYSTEM: NetBSD 3.1 http://secunia.com/product/16089/
DESCRIPTION: A vulnerability has been reported in NetBSD, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.
The vulnerability is caused due incorrect length check when processing tags within a PPPoE packet. This can be exploited to e.g. crash the kernel by sending a specially crafted PPPoE packet to a vulnerable system.
Successful exploitation requires that a PPPoE interface has been created (e.g. via ""ifconfig pppoe0 create") and the attacker can send PPPoE packets to the affected system.
The vulnerability is reported in NetBSD version 3.0, 3.1, and 4.0.
SOLUTION: Fixed in the CVS repository. See vendor advisory for details.
PROVIDED AND/OR DISCOVERED BY: The vendor credits Yasuoka Masahiko, Internet Initiative Japan Inc
ORIGINAL ADVISORY: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-010.txt.asc
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200809-0196",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "netbsd",
"scope": "eq",
"trust": 2.7,
"vendor": "netbsd",
"version": "4.0"
},
{
"model": "netbsd",
"scope": "eq",
"trust": 2.7,
"vendor": "netbsd",
"version": "3.1"
},
{
"model": "netbsd",
"scope": "eq",
"trust": 2.4,
"vendor": "netbsd",
"version": "3.0"
},
{
"model": "airmac express",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "base station"
},
{
"model": "airmac extreme",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "base station"
},
{
"model": "time capsule",
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
},
{
"model": "netbsd",
"scope": "eq",
"trust": 0.3,
"vendor": "netbsd",
"version": "3.0.2"
},
{
"model": "netbsd",
"scope": "eq",
"trust": 0.3,
"vendor": "netbsd",
"version": "3.0.1"
},
{
"model": "current",
"scope": null,
"trust": 0.3,
"vendor": "netbsd",
"version": null
},
{
"model": "financials server",
"scope": "eq",
"trust": 0.3,
"vendor": "navision",
"version": "3.0"
}
],
"sources": [
{
"db": "BID",
"id": "30838"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002305"
},
{
"db": "NVD",
"id": "CVE-2008-3584"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-115"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:netbsd:netbsd:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:netbsd:netbsd:3.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:netbsd:netbsd:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2008-3584"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Yasuoka Masahiko",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200809-115"
}
],
"trust": 0.6
},
"cve": "CVE-2008-3584",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2008-3584",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2008-3584",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200809-115",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-002305"
},
{
"db": "NVD",
"id": "CVE-2008-3584"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-115"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NetBSD 3.0, 3.1, and 4.0, when a pppoe instance exists, does not properly check the length of a PPPoE packet tag, which allows remote attackers to cause a denial of service (system crash) via a crafted PPPoE packet. NetBSD is prone to a remote denial-of-service vulnerability. \nAn attacker can exploit this issue to crash the affected computer, denying service to legitimate users. Given the nature of this issue, remote code execution may be possible, but this has not been confirmed. ----------------------------------------------------------------------\n\nWant a new job?\n\nhttp://secunia.com/secunia_security_specialist/\nhttp://secunia.com/hardcore_disassembler_and_reverse_engineer/\n\n----------------------------------------------------------------------\n\nTITLE:\nNetBSD PPPoE Packet Processing Tag Length Vulnerability\n\nSECUNIA ADVISORY ID:\nSA31597\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/31597/\n\nCRITICAL:\nLess critical\n\nIMPACT:\nDoS, System access\n\nWHERE:\n\u003eFrom local network\n\nOPERATING SYSTEM:\nNetBSD 3.1\nhttp://secunia.com/product/16089/\n\nDESCRIPTION:\nA vulnerability has been reported in NetBSD, which can be exploited\nby malicious people to cause a DoS (Denial of Service) and\npotentially compromise a vulnerable system. \n\nThe vulnerability is caused due incorrect length check when\nprocessing tags within a PPPoE packet. This can be exploited to e.g. \ncrash the kernel by sending a specially crafted PPPoE packet to a\nvulnerable system. \n\nSuccessful exploitation requires that a PPPoE interface has been\ncreated (e.g. via \"\"ifconfig pppoe0 create\") and the attacker can\nsend PPPoE packets to the affected system. \n\nThe vulnerability is reported in NetBSD version 3.0, 3.1, and 4.0. \n\nSOLUTION:\nFixed in the CVS repository. See vendor advisory for details. \n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits Yasuoka Masahiko, Internet Initiative Japan Inc\n\nORIGINAL ADVISORY:\nftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-010.txt.asc\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-3584"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002305"
},
{
"db": "BID",
"id": "30838"
},
{
"db": "PACKETSTORM",
"id": "69405"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-3584",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "31597",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2009-0633",
"trust": 2.4
},
{
"db": "BID",
"id": "30838",
"trust": 1.9
},
{
"db": "SECTRACK",
"id": "1020749",
"trust": 1.6
},
{
"db": "XF",
"id": "44679",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002305",
"trust": 0.8
},
{
"db": "NETBSD",
"id": "NETBSD-SA2008-010",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200809-115",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "69405",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "30838"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002305"
},
{
"db": "PACKETSTORM",
"id": "69405"
},
{
"db": "NVD",
"id": "CVE-2008-3584"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-115"
}
]
},
"id": "VAR-200809-0196",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.44479167
},
"last_update_date": "2023-12-18T10:44:50.794000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT3467",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht3467"
},
{
"title": "HT3467",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht3467?viewlocale=ja_jp"
},
{
"title": "NetBSD-SA2008-010",
"trust": 0.8,
"url": "ftp://ftp.netbsd.org/pub/netbsd/security/advisories/netbsd-sa2008-010.txt.asc"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-002305"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-002305"
},
{
"db": "NVD",
"id": "CVE-2008-3584"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://secunia.com/advisories/31597"
},
{
"trust": 2.4,
"url": "http://www.vupen.com/english/advisories/2009/0633"
},
{
"trust": 1.6,
"url": "ftp://ftp.netbsd.org/pub/netbsd/security/advisories/netbsd-sa2008-010.txt.asc"
},
{
"trust": 1.6,
"url": "http://support.apple.com/kb/ht3467"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/30838"
},
{
"trust": 1.6,
"url": "http://www.securitytracker.com/id?1020749"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/44679"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44679"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-3584"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-3584"
},
{
"trust": 0.3,
"url": "http://www.netbsd.org/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/31597/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/hardcore_disassembler_and_reverse_engineer/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_specialist/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/16089/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "BID",
"id": "30838"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002305"
},
{
"db": "PACKETSTORM",
"id": "69405"
},
{
"db": "NVD",
"id": "CVE-2008-3584"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-115"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "30838"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002305"
},
{
"db": "PACKETSTORM",
"id": "69405"
},
{
"db": "NVD",
"id": "CVE-2008-3584"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-115"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-08-26T00:00:00",
"db": "BID",
"id": "30838"
},
{
"date": "2009-04-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-002305"
},
{
"date": "2008-08-27T01:35:56",
"db": "PACKETSTORM",
"id": "69405"
},
{
"date": "2008-09-11T21:06:44.697000",
"db": "NVD",
"id": "CVE-2008-3584"
},
{
"date": "2008-08-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200809-115"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-05-07T17:24:00",
"db": "BID",
"id": "30838"
},
{
"date": "2009-04-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-002305"
},
{
"date": "2017-08-08T01:32:00.687000",
"db": "NVD",
"id": "CVE-2008-3584"
},
{
"date": "2009-03-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200809-115"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200809-115"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NetBSD Service disruption in (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-002305"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200809-115"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…