iproute 2.4.7 and earlier allows local users to cause a denial of service via spoofed messages as other users to the kernel netlink interface.

Herbert Xu discovered that iproute can accept spoofed messages sent via the kernel netlink interface by other users on the local machine.
This could lead to a local Denial of Service attack.

The updated packages have been patched to prevent this problem.

Herbert Xu reported that local users could cause a denial of service against iproute, a set of tools for controlling networking in Linux kernels. iproute uses the netlink interface to communicate with the kernel, but failed to verify that the messages it received came from the kernel (rather than from other user processes).

The remote host is affected by the vulnerability described in GLSA-200404-10 (iproute local Denial of Service vulnerability)

    It has been reported that iproute can accept spoofed messages on the kernel     netlink interface from local users. This could lead to a local Denial of     Service condition.
  Impact :

    Local users could cause a Denial of Service.
  Workaround :

     A workaround is not currently known for this issue. All users are advised      to upgrade to the latest version of the affected package.

This update of the iproute package fixes a security problem found in netlink. See CVE-2003-0856.

All users of the netlink application are very strongly advised to update to these latest packages.

  - Thu May 06 2004 Phil Knirsch <pknirsch at redhat.com>     2.4.7-13.2

  - Built security errata version for FC1.

  - Wed Apr 21 2004 Phil Knirsch <pknirsch at redhat.com>     2.4.7-14

  - Fixed -f option for ss (#118355).

    - Small description fix (#110997).

    - Added initialization of some vars (#74961).

    - Added patch to initialize 'default' rule as well       (#60693).

  - Fri Feb 13 2004 Elliot Lee <sopwith at redhat.com>

  - rebuilt

  - Wed Nov 05 2003 Phil Knirsch <pknirsch at redhat.com>     2.4.7-12

  - Security errata for netlink (CVE-2003-0856).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated iproute packages that close a locally-exploitable denial of service vulnerability are now available.

The iproute package contains advanced IP routing and network device configuration tools.

Herbert Xu reported that iproute can accept spoofed messages sent on the kernel netlink interface by other users on the local machine. This could lead to a local denial of service attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0856 to this issue.

Users of iproute should upgrade to these erratum packages, which contain a patch that checks that netlink messages actually came from the kernel.

ID	Name	Product	Family	Severity
15956	Mandrake Linux Security Advisory : iproute2 (MDKSA-2004:148)	Nessus	Mandriva Local Security Checks	medium
15329	Debian DSA-492-1 : iproute - denial of service	Nessus	Debian Local Security Checks	medium
14475	GLSA-200404-10 : iproute local Denial of Service vulnerability	Nessus	Gentoo Local Security Checks	medium
13694	Fedora Core 1 : iproute-2.4.7-13.2 (2004-115)	Nessus	Fedora Local Security Checks	medium
12432	RHEL 2.1 / 3 : iproute (RHSA-2003:317)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2003-0856

medium

Tenable Plugins

medium

medium

medium

medium

medium