CVE-2009-0687

The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://www.vupen.com/english/advisories/2009/1015	Patch Vendor Advisory
http://www.openbsd.org/errata45.html#002_pf	Patch Vendor Advisory
http://www.helith.net/txt/multiple_vendor-PF_null_pointer_dereference.txt
http://www.securityfocus.com/archive/1/502634
http://www.osvdb.org/53608
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-001.txt.asc	Vendor Advisory
http://www.openbsd.org/errata44.html#013_pf	Patch Vendor Advisory
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/013_pf.patch	Patch Vendor Advisory
http://www.openbsd.org/errata43.html#013_pf	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/49837
https://www.exploit-db.com/exploits/8581
https://www.exploit-db.com/exploits/8406

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:netbsd:netbsd:5.0:::::::*
	cpe:2.3:o:midnightbsd:midnightbsd:0.3-current:::::::*
	cpe:2.3:o:mirbsd:miros::::::::
	cpe:2.3:o:openbsd:openbsd:4.2:::::::*
	cpe:2.3:o:openbsd:openbsd:4.3:::::::*
	cpe:2.3:o:openbsd:openbsd:4.4:::::::*
	cpe:2.3:o:openbsd:openbsd:4.5:::::::*

Information

Published : 2009-08-11 03:30

Updated : 2017-09-28 18:33

NVD link : CVE-2009-0687

Mitre link : CVE-2009-0687

JSON object : View

CWE

CWE-399

Resource Management Errors

Products Affected

mirbsd

miros

openbsd

openbsd

midnightbsd

midnightbsd

netbsd

netbsd

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.vupen.com/english/advisories/2009/1015", "name": "ADV-2009-1015", "tags": ["Patch", "Vendor Advisory"], "refsource": "VUPEN"}, {"url": "http://www.openbsd.org/errata45.html#002_pf", "name": "[4.5] 002: RELIABILITY FIX: April 11, 2009", "tags": ["Patch", "Vendor Advisory"], "refsource": "OPENBSD"}, {"url": "http://www.helith.net/txt/multiple_vendor-PF_null_pointer_dereference.txt", "name": "http://www.helith.net/txt/multiple_vendor-PF_null_pointer_dereference.txt", "tags": [], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/archive/1/502634", "name": "20090413 OpenBSD 4.3 up to OpenBSD-current: PF null pointer dereference - remote DoS (kernel panic)", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.osvdb.org/53608", "name": "53608", "tags": [], "refsource": "OSVDB"}, {"url": "http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-001.txt.asc", "name": "NetBSD-SA2009-001", "tags": ["Vendor Advisory"], "refsource": "NETBSD"}, {"url": "http://www.openbsd.org/errata44.html#013_pf", "name": "[4.4] 013: RELIABILITY FIX: April 11, 2009", "tags": ["Patch", "Vendor Advisory"], "refsource": "OPENBSD"}, {"url": "ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/013_pf.patch", "name": "ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/013_pf.patch", "tags": ["Patch", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.openbsd.org/errata43.html#013_pf", "name": "[4.3] 013: RELIABILITY FIX: April 11, 2009", "tags": ["Patch", "Vendor Advisory"], "refsource": "OPENBSD"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49837", "name": "openbsd-packetfilter-dos(49837)", "tags": [], "refsource": "XF"}, {"url": "https://www.exploit-db.com/exploits/8581", "name": "8581", "tags": [], "refsource": "EXPLOIT-DB"}, {"url": "https://www.exploit-db.com/exploits/8406", "name": "8406", "tags": [], "refsource": "EXPLOIT-DB"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-399"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2009-0687", "ASSIGNER": "cert@cert.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "severity": "HIGH", "impactScore": 6.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2009-08-11T10:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:netbsd:netbsd:5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:midnightbsd:midnightbsd:0.3-current:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:mirbsd:miros:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "10"}, {"cpe23Uri": "cpe:2.3:o:openbsd:openbsd:4.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:openbsd:openbsd:4.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:openbsd:openbsd:4.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:openbsd:openbsd:4.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-09-29T01:33Z"}

7.8 /10