製品・ソフトウェアに関する情報

JVN脆弱性詳細

Linux kernel の appletalk サブシステムにおけるサービス運用妨害 (DoS) の脆弱性

Title	Linux kernel の appletalk サブシステムにおけるサービス運用妨害 (DoS) の脆弱性
Summary	Linux kernel の appletalk サブシステムは、appletalk および ipddp モジュールがロードされるが ipddp"N" デバイスが見つからない際、メモリリークにより、サービス運用妨害 (メモリ消費) 状態となる脆弱性が存在します。
Possible impacts	第三者により、IP-DDP データグラムを介して、サービス運用妨害 (メモリ消費) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 15, 2009, midnight
Registration Date	Sept. 25, 2012, 5:27 p.m.
Last Update	Sept. 25, 2012, 5:27 p.m.

Affected System

Linux

Linux Kernel 2.4.x から 2.4.37.6、および 2.6.x から 2.6.31

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-2903	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2903
National Vulnerability Database (NVD)
2	CVE-2009-2903	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2903

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-399	https://jvndb.jvn.jp/ja/cwe/CWE-399.html

ベンダー情報

No	Name	URL
kernel
1	Bug 522331	https://bugzilla.redhat.com/show_bug.cgi?id=522331

Change Log

No	Changed Details	Date of change
0	[2012年09月25日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2009-2903

Summary	Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddp"N" device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams.
Publication Date	Sept. 16, 2009, 7:30 a.m.
Registration Date	Jan. 29, 2021, 1:22 p.m.
Last Update	Feb. 13, 2023, 10:17 a.m.

Affected software configurations

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:suse:linux_enterprise_server:10:sp3::::::
cpe:2.3:o:suse:linux_enterprise_server:9:::::::*
cpe:2.3:o:suse:linux_enterprise_server:10:sp2::::::
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp2::::::
cpe:2.3:a:suse:linux_enterprise_debuginfo:10:sp2::::::
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp3::::::
cpe:2.3:a:suse:linux_enterprise_debuginfo:10:sp3::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp3::::::

Related information, measures and tools

No	URL	refsource	タグ
1	http://www.securityfocus.com/bid/36379	BID	Third Party Advisory VDB Entry
2	http://secunia.com/advisories/36707	SECUNIA	Third Party Advisory
3	http://www.openwall.com/lists/oss-security/2009/09/14/1	MLIST	Mailing List Third Party Advisory
4	http://www.openwall.com/lists/oss-security/2009/09/14/2	MLIST	Mailing List Third Party Advisory
5	https://bugzilla.redhat.com/show_bug.cgi?id=522331	CONFIRM	Issue Tracking Third Party Advisory
6	http://www.openwall.com/lists/oss-security/2009/09/17/11	MLIST	Mailing List Third Party Advisory
7	http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html	SUSE	Mailing List Third Party Advisory
8	http://www.mandriva.com/security/advisories?name=MDVSA-2009:329	MANDRIVA	Third Party Advisory
9	http://secunia.com/advisories/37909	SECUNIA	Third Party Advisory
10	http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html	SUSE	Mailing List Third Party Advisory
11	http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html	SUSE	Mailing List Third Party Advisory
12	http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.html	SUSE	Mailing List Third Party Advisory
13	http://secunia.com/advisories/37105	SECUNIA	Third Party Advisory
14	http://www.ubuntu.com/usn/USN-852-1	UBUNTU	Third Party Advisory
15	http://git.kernel.org/?p=linux/kernel/git/davem/net-next-2.6.git%3Ba=commit%3Bh=ffcfb8db540ff879c2a85bf7e404954281443414	MISC

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-772	有効なライフタイム後のリソースの解放の欠如	https://cwe.mitre.org/data/definitions/772.html

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:suse:linux_enterprise_server:10:sp3::::::
cpe:2.3:o:suse:linux_enterprise_server:9:::::::*
cpe:2.3:o:suse:linux_enterprise_server:10:sp2::::::
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp2::::::
cpe:2.3:a:suse:linux_enterprise_debuginfo:10:sp2::::::
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp3::::::
cpe:2.3:a:suse:linux_enterprise_debuginfo:10:sp3::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp3::::::