Vulnerabilities > CVE-2008-0177 - Unspecified vulnerability in Kame Ipcomp
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
The ipcomp6_input function in sys/netinet6/ipcomp_input.c in the KAME project before 20071201 does not properly check the return value of the m_pulldown function, which allows remote attackers to cause a denial of service (system crash) via an IPv6 packet with an IPComp header.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Exploit-Db
| description | Apple Mac OS X xnu. CVE-2008-0177. Dos exploits for multiple platform |
| file | exploits/multiple/dos/5191.c |
| id | EDB-ID:5191 |
| last seen | 2016-01-31 |
| modified | 2008-02-26 |
| platform | multiple |
| port | |
| published | 2008-02-26 |
| reporter | mu-b |
| source | https://www.exploit-db.com/download/5191/ |
| title | Apple Mac OS X xnu <= 1228.3.13 - IPv6-ipcomp Remote kernel DoS PoC |
| type | dos |
Nessus
NASL family MacOS X Local Security Checks NASL id MACOSX_10_5_3.NASL description The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. Mac OS X 10.5.3 contains security fixes for a number of programs. last seen 2020-06-01 modified 2020-06-02 plugin id 32477 published 2008-05-29 reporter This script is Copyright (C) 2008-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/32477 title Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # if (!defined_func("bn_random")) exit(0); if ( NASL_LEVEL < 3004 ) exit(0); include("compat.inc"); if (description) { script_id(32477); script_version("1.27"); script_cvs_date("Date: 2018/07/14 1:59:35"); script_cve_id("CVE-2005-3352", "CVE-2005-3357", "CVE-2006-3747", "CVE-2007-0071", "CVE-2007-1863", "CVE-2007-3847", "CVE-2007-4465", "CVE-2007-5000", "CVE-2007-5266", "CVE-2007-5268", "CVE-2007-5269", "CVE-2007-5275", "CVE-2007-6019", "CVE-2007-6359", "CVE-2007-6388", "CVE-2007-6612", "CVE-2008-0177", "CVE-2008-1027", "CVE-2008-1028", "CVE-2008-1030", "CVE-2008-1031", "CVE-2008-1032", "CVE-2008-1033", "CVE-2008-1034", "CVE-2008-1035", "CVE-2008-1036", "CVE-2008-1571", "CVE-2008-1572", "CVE-2008-1573", "CVE-2008-1574", "CVE-2008-1575", "CVE-2008-1576", "CVE-2008-1577", "CVE-2008-1578", "CVE-2008-1579", "CVE-2008-1580", "CVE-2008-1654", "CVE-2008-1655"); script_bugtraq_id("15834", "25489", "25957", "26840", "26930", "27133", "27642", "28633", "28694", "29480", "29481", "29483", "29484", "29486", "29487", "29488", "29489", "29490", "29491", "29492", "29493", "29500", "29501", "29511", "29513", "29514", "29520", "29521"); script_xref(name:"Secunia", value:"30430"); script_name(english:"Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities"); script_summary(english:"Check the version of Mac OS X"); script_set_attribute(attribute:"synopsis", value: "The remote host is missing a Mac OS X update that fixes various security issues." ); script_set_attribute(attribute:"description", value: "The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. Mac OS X 10.5.3 contains security fixes for a number of programs." ); script_set_attribute(attribute:"see_also", value:"http://support.apple.com/kb/HT1897" ); script_set_attribute(attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2008/May/msg00001.html" ); script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/advisories/14755" ); script_set_attribute(attribute:"solution", value: "Upgrade to Mac OS X 10.5.3 or later." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Apache Module mod_rewrite LDAP Protocol Buffer Overflow'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_cwe_id(20, 22, 79, 94, 119, 189, 200, 264, 352, 399); script_set_attribute(attribute:"plugin_publication_date", value: "2008/05/29"); script_set_attribute(attribute:"vuln_publication_date", value: "2005/12/13"); script_set_attribute(attribute:"patch_publication_date", value: "2008/05/28"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc."); script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl"); exit(0); } os = get_kb_item("Host/MacOSX/Version"); if (!os) os = get_kb_item("Host/OS"); if (!os) exit(0); if (ereg(pattern:"Mac OS X 10\.5\.[0-2]([^0-9]|$)", string:os)) security_hole(0);NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2008-003.NASL description The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-003 applied. This update contains security fixes for a number of programs. last seen 2020-06-01 modified 2020-06-02 plugin id 32478 published 2008-05-29 reporter This script is Copyright (C) 2008-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/32478 title Mac OS X Multiple Vulnerabilities (Security Update 2008-003) code # # (C) Tenable Network Security, Inc. # if (!defined_func("bn_random")) exit(0); if ( NASL_LEVEL < 3004 ) exit(0); include("compat.inc"); if (description) { script_id(32478); script_version("1.31"); script_cvs_date("Date: 2018/07/14 1:59:35"); script_cve_id("CVE-2005-3352", "CVE-2005-3357", "CVE-2006-3747", "CVE-2007-0071", "CVE-2007-1863", "CVE-2007-3847", "CVE-2007-4465", "CVE-2007-5000", "CVE-2007-5266", "CVE-2007-5268", "CVE-2007-5269", "CVE-2007-5275", "CVE-2007-6019", "CVE-2007-6359", "CVE-2007-6388", "CVE-2007-6612", "CVE-2008-0177", "CVE-2008-1027", "CVE-2008-1028", "CVE-2008-1030", "CVE-2008-1031", "CVE-2008-1032", "CVE-2008-1033", "CVE-2008-1034", "CVE-2008-1035", "CVE-2008-1036", "CVE-2008-1571", "CVE-2008-1572", "CVE-2008-1573", "CVE-2008-1574", "CVE-2008-1575", "CVE-2008-1576", "CVE-2008-1577", "CVE-2008-1578", "CVE-2008-1579", "CVE-2008-1580", "CVE-2008-1654", "CVE-2008-1655"); script_bugtraq_id("15834", "25489", "25957", "26840", "26930", "27133", "27642", "28694", "29480", "29481", "29483", "29484", "29486", "29487", "29488", "29489", "29490", "29491", "29492", "29493", "29500", "29501", "29511", "29513", "29514", "29520", "29521"); script_xref(name:"Secunia", value:"30430"); script_name(english:"Mac OS X Multiple Vulnerabilities (Security Update 2008-003)"); script_summary(english:"Check for the presence of Security Update 2008-003"); script_set_attribute(attribute:"synopsis", value: "The remote host is missing a Mac OS X update that fixes various security issues." ); script_set_attribute(attribute:"description", value: "The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-003 applied. This update contains security fixes for a number of programs." ); script_set_attribute(attribute:"see_also", value:"http://support.apple.com/kb/HT1897" ); script_set_attribute(attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2008/May/msg00001.html" ); script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/advisories/14755" ); script_set_attribute(attribute:"solution", value: "Install Security Update 2008-003 or later." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Apache Module mod_rewrite LDAP Protocol Buffer Overflow'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_cwe_id(20, 22, 79, 94, 119, 189, 200, 264, 352, 399); script_set_attribute(attribute:"plugin_publication_date", value: "2008/05/29"); script_set_attribute(attribute:"vuln_publication_date", value: "2005/12/13"); script_set_attribute(attribute:"patch_publication_date", value: "2008/05/28"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/MacOSX/packages", "Host/uname"); exit(0); } uname = get_kb_item("Host/uname"); if (!uname) exit(0); if (egrep(pattern:"Darwin.* (8\.[0-9]\.|8\.1[01]\.)", string:uname)) { packages = get_kb_item("Host/MacOSX/packages"); if (!packages) exit(0); if (!egrep(pattern:"^SecUpd(Srvr)?(2008-00[3-8]|2009-|20[1-9][0-9]-)", string:packages)) security_hole(0); }
Seebug
bulletinFamily exploit description BUGTRAQ ID: 27642 CVE(CAN) ID: CVE-2008-0177 KAME项目是6家日本公司协作为各种BSD系统所提供的免费IPv6、IPsec和Mobile IPv6实现。 KAME项目实现的IPv6协议栈存在漏洞，远程攻击者可能利用此漏洞导致服务器不可用。 如果BSD系统使用了KAME项目的IPv6实现的话，则在处理有IPComp头的IPv6报文时kame/sys/netinet6/ipcomp_input.c文件的ipcomp6_input()函数会出现空指针引用。如果将内核配置为处理IPsec和IPv6通讯的话，单个特制的IPv6报文可能导致内核忙碌。 FreeBSD FreeBSD 5.5 KAME KAME project 厂商补丁： FreeBSD ------- FreeBSD已经为此发布了一个安全公告（FreeBSD-SA-08:04）以及相应补丁: FreeBSD-SA-08:04：IPsec null pointer dereference panic 链接：<a href=ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-08:04.ipsec.asc target=_blank>ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-08:04.ipsec.asc</a> 补丁下载： 执行以下步骤之一： 1) 将有漏洞的系统升级到5-STABLE，或修改日期之后的RELENG_5_5安全版本。 2) 为当前系统打补丁： 以下补丁确认可应用于FreeBSD 5.5系统。 a) 从以下位置下载相关补丁，并使用PGP工具验证附带的PGP签名。 # fetch <a href=http://security.FreeBSD.org/patches/SA-08:04/ipsec.patch target=_blank>http://security.FreeBSD.org/patches/SA-08:04/ipsec.patch</a> # fetch <a href=http://security.FreeBSD.org/patches/SA-08:04/ipsec.patch.asc target=_blank>http://security.FreeBSD.org/patches/SA-08:04/ipsec.patch.asc</a> b) 应用补丁。 # cd /usr/src # patch < /path/to/patch c) 如<URL: <a href=http://www.freebsd.org/handbook/makeworld.html> target=_blank>http://www.freebsd.org/handbook/makeworld.html></a> 所述重新编译操作系统并重启系统。 KAME ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href=http://www.kame.net/dev/cvsweb2.cgi/kame/kame/sys/netinet6/ipcomp_input.c.diff?r1=1.36;r2=1.37 target=_blank>http://www.kame.net/dev/cvsweb2.cgi/kame/kame/sys/netinet6/ipcomp_input.c.diff?r1=1.36;r2=1.37</a> id SSV:2911 last seen 2017-11-19 modified 2008-02-20 published 2008-02-20 reporter Root title KAME Project IPv6 IPComp头远程拒绝服务漏洞 bulletinFamily exploit description No description provided by source. id SSV:65225 last seen 2017-11-19 modified 2014-07-01 published 2014-07-01 reporter Root source https://www.seebug.org/vuldb/ssvid-65225 title Apple Mac OS X xnu <= 1228.3.13 - IPv6-ipcomp Remote kernel DoS PoC bulletinFamily exploit description No description provided by source. id SSV:8169 last seen 2017-11-19 modified 2008-02-27 published 2008-02-27 reporter Root source https://www.seebug.org/vuldb/ssvid-8169 title Apple Mac OS X xnu <= 1228.3.13 ipv6-ipcomp Remote kernel DoS PoC
References
- http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet6/ipcomp_input.c?f=u&only_with_tag=netbsd-3-1
- http://www.kb.cert.org/vuls/id/110947
- http://www.securityfocus.com/bid/27642
- http://secunia.com/advisories/28788
- http://secunia.com/advisories/28816
- http://securitytracker.com/id?1019314
- http://security.freebsd.org/advisories/FreeBSD-SA-08:04.ipsec.asc
- http://secunia.com/advisories/28979
- http://secunia.com/advisories/29130
- http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
- http://www.us-cert.gov/cas/techalerts/TA08-150A.html
- http://secunia.com/advisories/30430
- http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html
- http://secunia.com/advisories/31074
- http://www.vupen.com/english/advisories/2008/0688
- http://www.vupen.com/english/advisories/2008/1697
- http://www.vupen.com/english/advisories/2008/2094/references
- http://www.vupen.com/english/advisories/2008/0441
- https://www.exploit-db.com/exploits/5191
- http://www.kame.net/dev/cvsweb2.cgi/kame/kame/sys/netinet6/ipcomp_input.c.diff?r1=1.36%3Br2=1.37