Name | CVE-2008-4609 |
Description | The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress. |
Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more) |
NVD severity | high (attack range: remote) |
The table below lists information on source packages.
Source Package | Release | Version | Status |
---|---|---|---|
linux (PTS) | jessie | 3.16.56-1+deb8u1 | vulnerable |
jessie (security) | 3.16.59-1 | vulnerable | |
stretch | 4.9.144-3 | vulnerable | |
stretch (security) | 4.9.110-3+deb9u6 | vulnerable | |
buster | 4.19.16-1 | vulnerable | |
sid | 4.19.20-1 | vulnerable |
The information below is based on the following data on fixed versions.
Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
---|---|---|---|---|---|---|
linux | source | (unstable) | (unfixed) | unimportant | ||
linux-2.6 | source | (unstable) | (unfixed) | unimportant | ||
linux-2.6.24 | source | (unstable) | (unfixed) | unimportant |
this is a design flaw in TCP itself; maximum impact is a denial-of-service
there is no upstream solution
see http://kbase.redhat.com/faq/docs/DOC-18730 for possible mitigation via iptables
also see usage of ipt_connlimit as a mitigation strategy