CVE-2010-3873

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The X.25 implementation in the Linux kernel before 2.6.36.2 does not properly parse facilities, which allows remote attackers to cause a denial of service (heap memory corruption and panic) or possibly have unspecified other impact via malformed (1) X25_FAC_CALLING_AE or (2) X25_FAC_CALLED_AE data, related to net/x25/x25_facilities.c and net/x25/x25_in.c, a different vulnerability than CVE-2010-4164.

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a6331d6f9a4298173b413cf99a40cc86a9d92c37

http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.html

http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html

http://openwall.com/lists/oss-security/2010/11/03/2

http://openwall.com/lists/oss-security/2010/11/04/3

http://secunia.com/advisories/43291

http://www.debian.org/security/2010/dsa-2126

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2

http://www.mandriva.com/security/advisories?name=MDVSA-2011:029

http://www.spinics.net/lists/netdev/msg145786.html

http://www.spinics.net/lists/netdev/msg145873.html

http://www.vupen.com/english/advisories/2011/0375

https://bugzilla.redhat.com/show_bug.cgi?id=649693

Details

Source: MITRE

Published: 2011-01-03

Updated: 2020-08-14

Type: CWE-119

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*

Configuration 3

OR

cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*

Tenable Plugins

View all (16 total)

IDNameProductFamilySeverity
74801openSUSE Security Update : kernel (openSUSE-SU-2012:1439-1)NessusSuSE Local Security Checks
critical
74658openSUSE Security Update : Kernel (openSUSE-SU-2012:0799-1)NessusSuSE Local Security Checks
critical
65103Ubuntu 10.04 LTS / 10.10 : linux-mvl-dove vulnerabilities (USN-1093-1)NessusUbuntu Local Security Checks
high
59161SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7915)NessusSuSE Local Security Checks
high
58229SuSE9 Security Update : the Linux kernel (YOU Patch Number 12677)NessusSuSE Local Security Checks
high
57854SuSE 11.1 Security Update : Linux kernel (SAT Patch Number 5732)NessusSuSE Local Security Checks
high
57853SuSE 11.1 Security Update : Linux Kernel (SAT Patch Numbers 5723 / 5725)NessusSuSE Local Security Checks
high
57659SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7918)NessusSuSE Local Security Checks
high
56643USN-1244-1 : linux-ti-omap4 vulnerabilitiesNessusUbuntu Local Security Checks
high
55077USN-1119-1 : linux-ti-omap4 vulnerabilitiesNessusUbuntu Local Security Checks
high
52476Ubuntu 9.10 : linux, linux-ec2 vulnerabilities (USN-1073-1)NessusUbuntu Local Security Checks
high
52475Ubuntu 8.04 LTS : linux vulnerabilities (USN-1072-1)NessusUbuntu Local Security Checks
high
52474Ubuntu 6.06 LTS : linux-source-2.6.15 vulnerabilities (USN-1071-1)NessusUbuntu Local Security Checks
high
51953SuSE9 Security Update : the Linux kernel (YOU Patch Number 12672)NessusSuSE Local Security Checks
high
51847Ubuntu 10.04 LTS / 10.10 : linux, linux-ec2 vulnerabilities (USN-1054-1)NessusUbuntu Local Security Checks
high
50825Debian DSA-2126-1 : linux-2.6 - privilege escalation/denial of service/information leakNessusDebian Local Security Checks
high