Vulnerabilities > CVE-2007-1357 - Denial Of Service vulnerability in Linux Kernel AppleTalk ATalk_Sum_SKB Function
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
COMPLETE Summary
The atalk_sum_skb function in AppleTalk for Linux kernel 2.6.x before 2.6.21, and possibly 2.4.x, allows remote attackers to cause a denial of service (crash) via an AppleTalk frame that is shorter than the specified length, which triggers a BUG_ON call when an attempt is made to perform a checksum.
Vulnerable Configurations
Exploit-Db
| description | Linux Kernel 2.6.x AppleTalk ATalk_Sum_SKB Function Denial Of Service Vulnerability. CVE-2007-1357. Dos exploit for linux platform |
| id | EDB-ID:29826 |
| last seen | 2016-02-03 |
| modified | 2007-04-09 |
| published | 2007-04-09 |
| reporter | Jean Delvare |
| source | https://www.exploit-db.com/download/29826/ |
| title | Linux Kernel 2.6.x - AppleTalk ATalk_Sum_SKB Function Denial of Service Vulnerability |
Nessus
NASL family SuSE Local Security Checks NASL id SUSE_KERNEL-3128.NASL description This kernel update fixes the following security problems : - CVE-2007-1000 A NULL pointer dereference in the IPv6 sockopt handling can be used by local attackers to read arbitrary kernel memory and so gain access to private information. - CVE-2007-1388 A NULL pointer dereference could be used by local attackers to cause a Oops / crash of the machine. - CVE-2007-1592 A possible double free in the ipv6/flowlabel handling was fixed. - CVE-2007-1357 A remote denial of service attack in the AppleTalk protocol handler was fixed. This attack is only possible on the local subnet, and requires the AppleTalk protocol module to be loaded (which is not done by default). and the following non security bugs : - patches.fixes/visor_write_race.patch: fix race allowing overstepping memory limit in visor_write (Mainline: 2.6.21) - patches.drivers/libata-ide-via-add-PCI-IDs: via82cxxx/pata_via: backport PCI IDs (254158). - libata: implement HDIO_GET_IDENTITY (255413). - sata_sil24: Add Adaptec 1220SA PCI ID. (Mainline: 2.6.21) - ide: backport hpt366 from devel tree (244502). - mm: fix madvise infinine loop (248167). - libata: hardreset on SERR_INTERNAL (241334). - limited WPA support for prism54 (207944) - jmicron: match class instead of function number (224784, 207707) - ahci: RAID mode SATA patch for Intel ICH9M (Mainline: 2.6.21) - libata: blacklist FUJITSU MHT2060BH for NCQ (Mainline: 2.6.21) - libata: add missing PM callbacks. (Mainline: 2.6.20) - patches.fixes/nfs-readdir-timestamp: Set meaningful value for fattr->time_start in readdirplus results. (244967). - patches.fixes/usb_volito.patch: wacom volito tablet not working (#248832). - patches.fixes/965-fix: fix detection of aperture size versus GTT size on G965 (#258013). - patches.fixes/sbp2-MODE_SENSE-fix.diff: use proper MODE SENSE, fixes recognition of device properties (261086) - patches.fixes/ipt_CLUSTERIP_refcnt_fix: ipv4/netfilter/ipt_CLUSTERIP.c - refcnt fix (238646) - patches.fixes/reiserfs-fix-vs-13060.diff: reiserfs: fix corruption with vs-13060 (257735). - patches.drivers/ati-rs400_200-480-disable-msi: pci-quirks: disable MSI on RS400-200 and RS480 (263893). - patches.drivers/libata-ahci-ignore-interr-on-SB600: ahci.c: walkaround for SB600 SATA internal error issue (#264792). Furthermore, CONFIG_USB_DEVICEFS has been re-enabled to allow use of USB in legacy applications like VMware. (#210899). last seen 2020-06-01 modified 2020-06-02 plugin id 27294 published 2007-10-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27294 title openSUSE 10 Security Update : kernel (kernel-3128) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1286.NASL description Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-0005 Daniel Roethlisberger discovered two buffer overflows in the cm4040 driver for the Omnikey CardMan 4040 device. A local user or malicious device could exploit this to execute arbitrary code in kernel space. - CVE-2007-0958 Santosh Eraniose reported a vulnerability that allows local users to read otherwise unreadable files by triggering a core dump while using PT_INTERP. This is related to CVE-2004-1073. - CVE-2007-1357 Jean Delvare reported a vulnerability in the appletalk subsystem. Systems with the appletalk module loaded can be triggered to crash by other systems on the local network via a malformed frame. - CVE-2007-1592 Masayuki Nakagawa discovered that flow labels were inadvertently being shared between listening sockets and child sockets. This defect can be exploited by local users to cause a DoS (Oops). last seen 2020-06-01 modified 2020-06-02 plugin id 25153 published 2007-05-03 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/25153 title Debian DSA-1286-1 : linux-2.6 - several vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2007-432.NASL description Updated to upstream linux kernel 2.6.20.6: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.5 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.6 CVE-2007-1357: The atalk_sum_skb function in AppleTalk for Linux kernel 2.6.x before 2.6.21, and possibly 2.4.x, allows remote attackers to cause a denial of service (crash) via an AppleTalk frame that is shorter than the specified length, which triggers a BUG_ON call when an attempt is made to perform a checksum. CVSS Severity: 3.3 (Low) Plus additional fixes: Bugfix for ATI SB600 SATA Routing bugfix Libata LBA48 bugfix Update libata NCQ blacklist Libata request sense bugfix SCSI error handler fix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 25047 published 2007-04-19 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/25047 title Fedora Core 6 : kernel-2.6.20-1.2944.fc6 (2007-432) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-464-1.NASL description Philipp Richter discovered that the AppleTalk protocol handler did not sufficiently verify the length of packets. By sending a crafted AppleTalk packet, a remote attacker could exploit this to crash the kernel. (CVE-2007-1357) Gabriel Campana discovered that the do_ipv6_setsockopt() function did not sufficiently verifiy option values for IPV6_RTHDR. A local attacker could exploit this to trigger a kernel crash. (CVE-2007-1388) A Denial of Service vulnerability was discovered in the nfnetlink_log() netfilter function. A remote attacker could exploit this to trigger a kernel crash. (CVE-2007-1496) The connection tracking module for IPv6 did not properly handle the status field when reassembling fragmented packets, so that the final packet always had the last seen 2020-06-01 modified 2020-06-02 plugin id 28064 published 2007-11-10 reporter Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/28064 title Ubuntu 6.06 LTS / 6.10 / 7.04 : linux-source-2.6.15/2.6.17/2.6.20 vulnerabilities (USN-464-1) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1304.NASL description CVE-2006-6060 CVE-2006-6106 CVE-2006-6535 CVE-2007-0958 CVE-2007-1357 CVE-2007-1592 Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. This update also fixes a regression in the smbfs subsystem which was introduced in DSA-1233which caused symlinks to be interpreted as regular files. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-4811 David Gibson reported an issue in the hugepage code which could permit a local DoS (system crash) on appropriately configured systems. - CVE-2006-4814 Doug Chapman discovered a potential local DoS (deadlock) in the mincore function caused by improper lock handling. - CVE-2006-4623 Ang Way Chuang reported a remote DoS (crash) in the dvb driver which can be triggered by a ULE package with an SNDU length of 0. - CVE-2006-5753 Eric Sandeen provided a fix for a local memory corruption vulnerability resulting from a misinterpretation of return values when operating on inodes which have been marked bad. - CVE-2006-5754 Darrick Wong discovered a local DoS (crash) vulnerability resulting from the incorrect initialization of last seen 2020-06-01 modified 2020-06-02 plugin id 25529 published 2007-06-18 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25529 title Debian DSA-1304-1 : kernel-source-2.6.8 - several vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2007-433.NASL description Updated to upstream linux kernel 2.6.20.6: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.5 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.6 CVE-2007-1357: The atalk_sum_skb function in AppleTalk for Linux kernel 2.6.x before 2.6.21, and possibly 2.4.x, allows remote attackers to cause a denial of service (crash) via an AppleTalk frame that is shorter than the specified length, which triggers a BUG_ON call when an attempt is made to perform a checksum. CVSS Severity: 3.3 (Low) Plus additional fixes: ATI SB600 SATA workaround Routing return codes Libata LBA48 handling Update libata NCQ blacklist Libata request sense SCSI error handler Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 25048 published 2007-04-19 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/25048 title Fedora Core 5 : kernel-2.6.20-1.2312.fc5 (2007-433)
References
- http://lists.suse.com/archive/suse-security-announce/2007-May/0001.html
- http://secunia.com/advisories/24793
- http://secunia.com/advisories/24901
- http://secunia.com/advisories/25078
- http://secunia.com/advisories/25099
- http://secunia.com/advisories/25226
- http://secunia.com/advisories/25392
- http://secunia.com/advisories/25683
- http://secunia.com/advisories/25691
- http://secunia.com/advisories/25714
- http://secunia.com/advisories/25961
- http://www.debian.org/security/2007/dsa-1286
- http://www.debian.org/security/2007/dsa-1304
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.5
- http://www.novell.com/linux/security/advisories/2007_30_kernel.html
- http://www.novell.com/linux/security/advisories/2007_35_kernel.html
- http://www.novell.com/linux/security/advisories/2007_43_kernel.html
- http://www.securityfocus.com/archive/1/471457
- http://www.securityfocus.com/bid/23376
- http://www.ubuntu.com/usn/usn-464-1
- http://www.vupen.com/english/advisories/2007/1340
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235857
- https://issues.rpath.com/browse/RPL-1244