Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | New rt2400 packages fix arbitrary code execution |
| Informations | |||
|---|---|---|---|
| Name | DSA-1712 | First vendor Publication | 2009-01-28 |
| Vendor | Debian | Last vendor Modification | 2009-01-28 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| It was discovered that an integer overflow in the "Probe Request" packet parser of the Ralinktech wireless drivers might lead to remote denial of service or the execution of arbitrary code. Please note that you need to rebuild your driver from the source package in order to set this update into effect. Detailed instructions can be found in /usr/share/doc/rt2400-source/README.Debian For the stable distribution (etch), this problem has been fixed in version 1.2.2+cvs20060620-4+etch1. For the upcoming stable distribution (lenny) and the unstable distribution (sid), this problem has been fixed in version 1.2.2+cvs20080623-3. We recommend that you upgrade your rt2400 package. |
Original Source
| Url : http://www.debian.org/security/2009/dsa-1712 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13092 | |||
| Oval ID: | oval:org.mitre.oval:def:13092 | ||
| Title: | DSA-1714-1 rt2570 -- integer overflow | ||
| Description: | It was discovered that an integer overflow in the "Probe Request" packet parser of the Ralinktech wireless drivers might lead to remote denial of service or the execution of arbitrary code. Please note that you need to rebuild your driver from the source package in order to set this update into effect. Detailed instructions can be found in /usr/share/doc/rt2570-source/README.Debian For the stable distribution, this problem has been fixed in version 1.1.0+cvs20060620-3+etch1. For the upcoming stable distribution and the unstable distribution, this problem has been fixed in version 1.1.0+cvs20080623-2. We recommend that you upgrade your rt2570 package. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1714-1 CVE-2009-0282 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | rt2570 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:13559 | |||
| Oval ID: | oval:org.mitre.oval:def:13559 | ||
| Title: | DSA-1713-1 rt2500 -- integer overflow | ||
| Description: | It was discovered that an integer overflow in the "Probe Request" packet parser of the Ralinktech wireless drivers might lead to remote denial of service or the execution of arbitrary code. Please note that you need to rebuild your driver from the source package in order to set this update into effect. Detailed instructions can be found in /usr/share/doc/rt2500-source/README.Debian For the stable distribution, this problem has been fixed in version 1.1.0+cvs20060620-3+etch1. For the upcoming stable distribution and the unstable distribution , this problem has been fixed in version 1:1.1.0-b4+cvs20080623-3. We recommend that you upgrade your rt2500 package. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1713-1 CVE-2009-0282 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | rt2500 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13843 | |||
| Oval ID: | oval:org.mitre.oval:def:13843 | ||
| Title: | DSA-1712-1 rt2400 -- integer overflow | ||
| Description: | It was discovered that an integer overflow in the "Probe Request" packet parser of the Ralinktech wireless drivers might lead to remote denial of service or the execution of arbitrary code. Please note that you need to rebuild your driver from the source package in order to set this update into effect. Detailed instructions can be found in /usr/share/doc/rt2400-source/README. Debian For the stable distribution, this problem has been fixed in version 1.2.2+cvs20060620-4+etch1. For the upcoming stable distribution and the unstable distribution, this problem has been fixed in version 1.2.2+cvs20080623-3. We recommend that you upgrade your rt2400 package. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1712-1 CVE-2009-0282 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | rt2400 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7173 | |||
| Oval ID: | oval:org.mitre.oval:def:7173 | ||
| Title: | DSA-1712 rt2400 -- integer overflow | ||
| Description: | It was discovered that an integer overflow in the "Probe Request" packet parser of the Ralinktech wireless drivers might lead to remote denial of service or the execution of arbitrary code. Please note that you need to rebuild your driver from the source package in order to set this update into effect. Detailed instructions can be found in /usr/share/doc/rt2400-source/README.Debian | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1712 CVE-2009-0282 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | rt2400 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7724 | |||
| Oval ID: | oval:org.mitre.oval:def:7724 | ||
| Title: | DSA-1713 rt2500 -- integer overflow | ||
| Description: | It was discovered that an integer overflow in the "Probe Request" packet parser of the Ralinktech wireless drivers might lead to remote denial of service or the execution of arbitrary code. Please note that you need to rebuild your driver from the source package in order to set this update into effect. Detailed instructions can be found in /usr/share/doc/rt2500-source/README.Debian | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1713 CVE-2009-0282 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | rt2500 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7797 | |||
| Oval ID: | oval:org.mitre.oval:def:7797 | ||
| Title: | DSA-1714 rt2570 -- integer overflow | ||
| Description: | It was discovered that an integer overflow in the "Probe Request" packet parser of the Ralinktech wireless drivers might lead to remote denial of service or the execution of arbitrary code. Please note that you need to rebuild your driver from the source package in order to set this update into effect. Detailed instructions can be found in /usr/share/doc/rt2570-source/README.Debian | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1714 CVE-2009-0282 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | rt2570 |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Hardware | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-07-29 | Name : Gentoo Security Advisory GLSA 200907-08 (rt2400 rt2500 rt2570 rt61 ralink-rt61) File : nvt/glsa_200907_08.nasl |
| 2009-02-02 | Name : Debian Security Advisory DSA 1712-1 (rt2400) File : nvt/deb_1712_1.nasl |
| 2009-02-02 | Name : Debian Security Advisory DSA 1713-1 (rt2500) File : nvt/deb_1713_1.nasl |
| 2009-02-02 | Name : Debian Security Advisory DSA 1714-1 (rt2570) File : nvt/deb_1714_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 53551 | Ralink Technology USB Wireless Adapter (RT73) Probe Request Packet SSID Handl... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-07-13 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200907-08.nasl - Type : ACT_GATHER_INFO |
| 2009-01-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1712.nasl - Type : ACT_GATHER_INFO |
| 2009-01-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1713.nasl - Type : ACT_GATHER_INFO |
| 2009-01-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1714.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:28:09 |
|
