Secunia

A vulnerability has been identified in Linux Kernel 2.0 branch allowing malicious people to see random parts of the memory.

The problem is that the Linux Kernel fails to calculate the size for an ICMP error response. This causes the Linux Kernel to return too much data when sending ICMP errors.

The data which is returned by the Kernel appears to be random data from memory. This could lead to exposure of passwords, system configuration and more.

Apparently, there is no way for a malicious person to control what parts of memory the data comes from.

Linux Kernel versions 2.0 to 2.0.39 are vulnerable.
WatchGuard FireBox II and III are vulnerable.

Solution
It has been reported that Linux Kernel version 2.0.40 soon will be released.
Further details available in Customer Area

Provided and/or discovered by
Philippe Biondi, Cartel Sécurité.

Original Advisory
http://www.cartel-securite.fr/pbiondi/adv/CARTSA-20030314-icmpleak.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area