[kernel-sec-discuss] r1661 - active ignored
Michael Gilbert
gilbert-guest at alioth.debian.org
Sat Dec 19 21:03:37 UTC 2009
Author: gilbert-guest
Date: 2009-12-19 21:03:37 +0000 (Sat, 19 Dec 2009)
New Revision: 1661
Added:
ignored/CVE-2008-4609
Removed:
active/CVE-2008-4609
Log:
move tcp design flaw to ignored issues
Deleted: active/CVE-2008-4609
===================================================================
--- active/CVE-2008-4609 2009-12-19 21:03:31 UTC (rev 1660)
+++ active/CVE-2008-4609 2009-12-19 21:03:37 UTC (rev 1661)
@@ -1,25 +0,0 @@
-Candidate: CVE-2008-4609
-Description:
- The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft
- Windows, (4) Cisco products, and probably other operating systems allows remote
- attackers to cause a denial of service (connection queue exhaustion) via multiple
- vectors that manipulate information in the TCP state table, as demonstrated by
- sockstress.
-References:
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4609
- http://www.openwall.com/lists/oss-security/2009/09/16/4
- http://www.openwall.com/lists/oss-security/2009/09/16/5
- http://kbase.redhat.com/faq/docs/DOC-18730
- http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf
-Ubuntu-Description:
-Notes:
- - apparently some fundamental flaws in tcp. microsoft patched this in versions >xp.
- - lots of speculation but not much definitive. not sure whether its too big of a deal
- - just denial-of-services?
- - ignored by redhat
-Bugs:
-upstream:
-linux-2.6:
-2.6.18-etch-security: ignored
-2.6.24-etch-security: ignored
-2.6.26-lenny-security: ignored ("no upstream fix")
Copied: ignored/CVE-2008-4609 (from rev 1660, active/CVE-2008-4609)
===================================================================
--- ignored/CVE-2008-4609 (rev 0)
+++ ignored/CVE-2008-4609 2009-12-19 21:03:37 UTC (rev 1661)
@@ -0,0 +1,25 @@
+Candidate: CVE-2008-4609
+Description:
+ The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft
+ Windows, (4) Cisco products, and probably other operating systems allows remote
+ attackers to cause a denial of service (connection queue exhaustion) via multiple
+ vectors that manipulate information in the TCP state table, as demonstrated by
+ sockstress.
+References:
+ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4609
+ http://www.openwall.com/lists/oss-security/2009/09/16/4
+ http://www.openwall.com/lists/oss-security/2009/09/16/5
+ http://kbase.redhat.com/faq/docs/DOC-18730
+ http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf
+Ubuntu-Description:
+Notes:
+ - apparently some fundamental flaws in tcp. microsoft patched this in versions >xp.
+ - lots of speculation but not much definitive. not sure whether its too big of a deal
+ - just denial-of-services?
+ - ignored by redhat
+Bugs:
+upstream:
+linux-2.6:
+2.6.18-etch-security: ignored
+2.6.24-etch-security: ignored
+2.6.26-lenny-security: ignored ("no upstream fix")
More information about the kernel-sec-discuss
mailing list