Description
The ipcomp6_input function in sys/netinet6/ipcomp_input.c in the KAME project before 20071201 does not properly check the return value of the m_pulldown function, which allows remote attackers to cause a denial of service (system crash) via an IPv6 packet with an IPComp header.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Apple Mac OSX xnu 1228.3.13 - IPv6-ipcomp Remote kernel Denial of Service (PoC) EDB-5191 · dos · Feb 26, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 28816 third-party-advisory
- ADV-2008-0688 vdb-entry
- ADV-2008-0441 vdb-entry
- http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet6/ipcomp_input.c?f=u&only_with_tag=netbsd-3-1
- 27642 vdb-entry
- 28788 third-party-advisory
- FreeBSD-SA-08:04 vendor-advisory
- TA08-150A third-party-advisory
- 29130 third-party-advisory
- 28979 third-party-advisory
- 30430 third-party-advisory
- APPLE-SA-2008-05-28 vendor-advisory
- http://www.kame.net/dev/cvsweb2.cgi/kame/kame/sys/netinet6/ipcomp_input.c.diff?r1=1.36%3Br2=1.37
- APPLE-SA-2008-07-11 vendor-advisory
- ADV-2008-2094 vdb-entry
- ADV-2008-1697 vdb-entry
- 1019314 vdb-entry
- VU#110947 third-party-advisory
- 31074 third-party-advisory
- 5191 exploit