|
NetPerformer Products Denial of Service Vulnerabilities
|
|
Secunia Advisory:
|
SA21876
|
|
|
Release Date:
|
2006-09-14
|
|
Last Update:
|
2006-09-20
|
|
Popularity:
|
5,519 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
DoS
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| OS: | NetPerformer SDM-9220
NetPerformer SDM-9230
NetPerformer SDM-9380
NetPerformer SDM-9500
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-4832
CVE-2006-4833
|
|
Description:
Arif Jatmoko has reported two vulnerabilities in various NetPerformer products, which can be exploited by malicious people to cause a DoS (Denial of Service).
1) An error in the login handling in the telnet service can be exploited to crash and reboot a vulnerable device by sending an overly long username (more than 4550 characters).
2) An error in the handling of ICMP packets can be exploited to hang a vulnerable device by sending a spoofed ICMP packet to the device via a LAND attack where the source address is the same as the device address.
The vulnerabilities have been reported in the following products:
* NetPerformer SDM-95xx version 7.x (R1)
* NetPerformer SDM-93xx version 10.x (R2)
* NetPerformer SDM-92xx version 9.x (R1)
Solution:
Filter traffic to the telnet service and filter ICMP packets to the device where the source address is the same as the destination address.
Provided and/or discovered by:
Arif Jatmoko
Changelog:
2006-09-20: Added CVE references.
Original Advisory:
http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049434.html
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
