Executive Summary

Informations
Name CVE-2009-4272 First vendor Publication 2010-01-27
Vendor Cve Last vendor Modification 2024-02-15

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Overall CVSS Score 7.5
Base Score 7.5 Environmental Score 7.5
impact SubScore 3.6 Temporal Score 7.5
Exploitabality Sub Score 3.9
 
Attack Vector Network Attack Complexity Low
Privileges Required None User Interaction None
Scope Unchanged Confidentiality Impact None
Integrity Impact None Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C)
Cvss Base Score 7.8 Attack Range Network
Cvss Impact Score 6.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4272

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-667 Insufficient Locking

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11167
 
Oval ID: oval:org.mitre.oval:def:11167
Title: A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.
Description: A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.
Family: unix Class: vulnerability
Reference(s): CVE-2009-4272
 Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21777
 
Oval ID: oval:org.mitre.oval:def:21777
Title: RHSA-2010:0046: kernel security and bug fix update (Important)
Description: A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.
Family: unix Class: patch
Reference(s): RHSA-2010:0046-01
CESA-2010:0046
CVE-2006-6304
CVE-2009-2910
CVE-2009-3080
CVE-2009-3556
CVE-2009-3889
CVE-2009-3939
CVE-2009-4020
CVE-2009-4021
CVE-2009-4138
CVE-2009-4141
CVE-2009-4272
 Version: 146
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
 Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22940
 
Oval ID: oval:org.mitre.oval:def:22940
Title: ELSA-2010:0046: kernel security and bug fix update (Important)
Description: A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.
Family: unix Class: patch
Reference(s): ELSA-2010:0046-01
CVE-2006-6304
CVE-2009-2910
CVE-2009-3080
CVE-2009-3556
CVE-2009-3889
CVE-2009-3939
CVE-2009-4020
CVE-2009-4021
CVE-2009-4138
CVE-2009-4141
CVE-2009-4272
 Version: 49
Platform(s): Oracle Linux 5
 Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7026
 
Oval ID: oval:org.mitre.oval:def:7026
Title: Red Hat Linux Kernel Routing Implementation Multiple Remote Denial of Service Vulnerabilities
Description: A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.
Family: unix Class: vulnerability
Reference(s): CVE-2009-4272
 Version: 5
Platform(s): VMWare ESX Server 4.0
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Os 1

OpenVAS Exploits

Date Description
2012-04-16 Name : VMSA-2010-0009: ESXi utilities and ESX Service Console third party updates
File : nvt/gb_VMSA-2010-0009.nasl
2011-08-09 Name : CentOS Update for kernel CESA-2010:0046 centos5 i386
File : nvt/gb_CESA-2010_0046_kernel_centos5_i386.nasl
2010-01-20 Name : RedHat Update for kernel RHSA-2010:0046-01
File : nvt/gb_RHSA-2010_0046-01_kernel.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
62122 Linux Kernel on Red Hat net/ipv4/route.c IPv4 Routing Hash Table Packet Colli...

Information Assurance Vulnerability Management (IAVM)

Date Description
2010-01-28 IAVM : 2010-A-0015 - Multiple Vulnerabilities in Red Hat Linux Kernel
Severity : Category I - VMSKEY : V0022631

Nessus® Vulnerability Scanner

Date Description
2016-03-08 Name : The remote VMware ESX / ESXi host is missing a security-related patch.
File : vmware_VMSA-2010-0009_remote.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0046.nasl - Type : ACT_GATHER_INFO
2010-06-01 Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2010-0009.nasl - Type : ACT_GATHER_INFO
2010-01-21 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0046.nasl - Type : ACT_GATHER_INFO
2010-01-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0046.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
CONFIRM http://support.avaya.com/css/P8/documents/100073666
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.31
https://bugzilla.redhat.com/show_bug.cgi?id=545411
MISC http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3...
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3...
MLIST http://www.openwall.com/lists/oss-security/2010/01/20/1
http://www.openwall.com/lists/oss-security/2010/01/20/6
OVAL https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT https://rhn.redhat.com/errata/RHSA-2010-0046.html
https://rhn.redhat.com/errata/RHSA-2010-0095.html
XF https://exchange.xforce.ibmcloud.com/vulnerabilities/55808

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
Date Informations
2024-02-16 05:28:15
  • Multiple Updates
2024-02-02 01:12:02
  • Multiple Updates
2024-02-01 12:03:22
  • Multiple Updates
2023-11-07 21:47:38
  • Multiple Updates
2023-09-05 12:11:20
  • Multiple Updates
2023-09-05 01:03:13
  • Multiple Updates
2023-09-02 12:11:23
  • Multiple Updates
2023-09-02 01:03:15
  • Multiple Updates
2023-08-12 12:13:22
  • Multiple Updates
2023-08-12 01:03:14
  • Multiple Updates
2023-08-11 12:11:26
  • Multiple Updates
2023-08-11 01:03:22
  • Multiple Updates
2023-08-06 12:10:59
  • Multiple Updates
2023-08-06 01:03:16
  • Multiple Updates
2023-08-04 12:11:04
  • Multiple Updates
2023-08-04 01:03:17
  • Multiple Updates
2023-07-14 12:11:00
  • Multiple Updates
2023-07-14 01:03:16
  • Multiple Updates
2023-03-29 01:12:38
  • Multiple Updates
2023-03-28 12:03:22
  • Multiple Updates
2023-02-13 09:29:13
  • Multiple Updates
2023-02-02 21:28:54
  • Multiple Updates
2020-05-23 00:24:42
  • Multiple Updates
2017-09-19 09:23:31
  • Multiple Updates
2017-08-17 09:22:48
  • Multiple Updates
2016-04-26 19:18:44
  • Multiple Updates
2016-03-09 13:25:54
  • Multiple Updates
2014-02-17 10:52:38
  • Multiple Updates
2013-11-11 12:38:29
  • Multiple Updates
2013-05-11 00:02:06
  • Multiple Updates