Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2009-4537

Overview

Vulnerability Score 7.8 7.8
CVE Id CVE-2009-4537
Last Modified 19 Mar 2012 12:00:00
Published 12 Jan 2010 12:30:00
Confidentiality Impact NONE NONE
Integrity Impact NONE NONE
Availability Impact COMPLETE COMPLETE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2009-4537

Summary

drivers/net/r8169.c in the r8169 driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to (1) cause a denial of service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of service (system crash) via a packet with a crafted size, in conjunction with certain packets containing '\0' characters, related to the value of the status register and erroneous behavior associated with the RxMaxSize register. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389.

Vulnerable Systems

Operating System

  • Linux Kernel 2.2.27

  • Linux Kernel 2.4.36

  • Linux Kernel 2.4.36.1

  • Linux Kernel 2.4.36.2

  • Linux Kernel 2.4.36.3

  • Linux Kernel 2.4.36.4

  • Linux Kernel 2.4.36.5

  • Linux Kernel 2.4.36.6

  • Linux Kernel 2.6

  • Linux Kernel 2.6.18

  • Linux Kernel 2.6.19.4

  • Linux Kernel 2.6.19.5

  • Linux Kernel 2.6.19.6

  • Linux Kernel 2.6.19.7

  • Linux Kernel 2.6.20.16

  • Linux Kernel 2.6.20.17

  • Linux Kernel 2.6.20.18

  • Linux Kernel 2.6.20.19

  • Linux Kernel 2.6.20.20

  • Linux Kernel 2.6.20.21

  • Linux Kernel 2.6.21.5

  • Linux Kernel 2.6.21.6

  • Linux Kernel 2.6.21.7

  • Linux Kernel 2.6.22

  • Linux Kernel 2.6.22 Rc1

  • Linux Kernel 2.6.22 Rc7

  • Linux Kernel 2.6.22.1

  • Linux Kernel 2.6.22.10

  • Linux Kernel 2.6.22.11

  • Linux Kernel 2.6.22.12

  • Linux Kernel 2.6.22.13

  • Linux Kernel 2.6.22.14

  • Linux Kernel 2.6.22.15

  • Linux Kernel 2.6.22.17

  • Linux Kernel 2.6.22.18

  • Linux Kernel 2.6.22.19

  • Linux Kernel 2.6.22.2

  • Linux Kernel 2.6.22.20

  • Linux Kernel 2.6.22.21

  • Linux Kernel 2.6.22.22

  • Linux Kernel 2.6.22.8

  • Linux Kernel 2.6.22.9

  • Linux Kernel 2.6.23

  • Linux Kernel 2.6.23 Rc1

  • Linux Kernel 2.6.23.10

  • Linux Kernel 2.6.23.11

  • Linux Kernel 2.6.23.12

  • Linux Kernel 2.6.23.13

  • Linux Kernel 2.6.23.15

  • Linux Kernel 2.6.23.16

  • Linux Kernel 2.6.23.17

  • Linux Kernel 2.6.23.8

  • Linux Kernel 2.6.23.9

  • Linux Kernel 2.6.24

  • Linux Kernel 2.6.24 Rc1

  • Linux Kernel 2.6.24 Rc4

  • Linux Kernel 2.6.24 Rc5

  • Linux Kernel 2.6.24.1

  • Linux Kernel 2.6.24.2

  • Linux Kernel 2.6.24.3

  • Linux Kernel 2.6.24.4

  • Linux Kernel 2.6.24.5

  • Linux Kernel 2.6.24.6

  • Linux Kernel 2.6.25

  • Linux Kernel 2.6.25.1

  • Linux Kernel 2.6.25.10

  • Linux Kernel 2.6.25.11

  • Linux Kernel 2.6.25.12

  • Linux Kernel 2.6.25.13

  • Linux Kernel 2.6.25.14

  • Linux Kernel 2.6.25.16

  • Linux Kernel 2.6.25.17

  • Linux Kernel 2.6.25.2

  • Linux Kernel 2.6.25.3

  • Linux Kernel 2.6.25.4

  • Linux Kernel 2.6.25.5

  • Linux Kernel 2.6.25.6

  • Linux Kernel 2.6.25.7

  • Linux Kernel 2.6.25.8

  • Linux Kernel 2.6.25.9

  • Linux Kernel 2.6.26

  • Linux Kernel 2.6.26.1

  • Linux Kernel 2.6.26.2

  • Linux Kernel 2.6.26.3

  • Linux Kernel 2.6.26.4

  • Linux Kernel 2.6.26.5

  • Linux Kernel 2.6.27

  • Linux Kernel 2.6.28

  • Linux Kernel 2.6.29

  • Linux Kernel 2.6.29.3

  • Linux Kernel 2.6.29.rc1

  • Linux Kernel 2.6.29.rc2-git1

  • Linux Kernel 2.6.30

  • Linux Kernel 2.6.32

  • Linux Kernel 2.6.32.1

  • Linux Kernel 2.6.32.2

  • Linux Kernel 2.6.32.3

Application

  • Intel E1000 5.2.22

  • Intel E1000 5.2.30.1

  • Intel E1000 5.2.52

  • Intel E1000 5.3.19

  • Intel E1000 5.4.11

  • Intel E1000 5.5.4

  • Intel E1000 5.6.10

  • Intel E1000 5.6.10.1

  • Intel E1000 5.7.6

  • Intel E1000 6.0.54

  • Intel E1000 6.0.60

  • Intel E1000 6.1.16

  • Intel E1000 6.2.15

  • Intel E1000 6.3.9

  • Intel E1000 7.0.33

  • Intel E1000 7.0.41

  • Intel E1000 7.1.9

  • Intel E1000 7.2.7

  • Intel E1000 7.2.9

  • Intel E1000 7.3.15

  • Intel E1000 7.3.20

  • Intel E1000 7.4.27

  • Intel E1000 7.4.35

  • Linux Kernel 2.6.24.7

  • Linux Kernel 2.6.25.15


References

REDHAT - RHSA-2010:0095

CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=550907

XF - kernel-r8169-dos(55647)

VUPEN - ADV-2010-1857

BID - 37521

REDHAT - RHSA-2010:0111

REDHAT - RHSA-2010:0053

REDHAT - RHSA-2010:0041

REDHAT - RHSA-2010:0020

REDHAT - RHSA-2010:0019

MLIST - [oss-security] 20091231 Re: CVE requests - kernel security regressions for CVE-2009-1385/and -1389

MLIST - [oss-security] 20091229 Re: CVE requests - kernel security regressions for CVE-2009-1385/and -1389

MLIST - [oss-security] 20091228 CVE requests - kernel security regressions for CVE-2009-1385/and -1389

SUSE - SUSE-SA:2010:023

DEBIAN - DSA-2053

MISC - http://twitter.com/dakami/statuses/7104238406

SECTRACK - 1023419

SECUNIA - 40645

SECUNIA - 39830

SECUNIA - 39742

SECUNIA - 38610

SECUNIA - 38031

CONFIRM - http://marc.info/?t=126202986900002&r=1&w=2

MLIST - [linux-netdev] 20091228 [PATCH RFC] r8169: straighten out overlength frame detection

SUSE - SUSE-SA:2010:031

FEDORA - FEDORA-2010-1787

MISC - http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html

MISC - http://blog.c22.cc/2009/12/27/26c3-cat-procsysnetipv4fuckups/

Related Patches

Novell SUSE 2010:7011 kernel security update for SLE 10 SP2 i586


Last Updated: 27 May 2016 10:59:53