NVD Vulnerability Detail

CVE-2009-1633

Summary	Multiple buffer overflows in the cifs subsystem in the Linux kernel before 2.6.29.4 allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess.c; or (2) long Unicode characters, related to fs/cifs/cifssmb.c and the cifs_readdir function in fs/cifs/readdir.c.
Publication Date	May 29, 2009, 5:30 a.m.
Registration Date	Jan. 29, 2021, 1:18 p.m.
Last Update	Nov. 7, 2023, 11:03 a.m.

CVSS2.0 : HIGH
Score	7.1
Vector	AV:N/AC:M/Au:N/C:N/I:N/A:C
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:linux:linux_kernel::::::::					2.6.29.4

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:5.0:::::::*
cpe:2.3:o:debian:debian_linux:4.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:6.06::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:9.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:8.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:8.10:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	https://bugzilla.redhat.com/show_bug.cgi?id=496572	CONFIRM	Issue Tracking Patch Third Party Advisory
2	https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01126.html	FEDORA	Patch Third Party Advisory
3	http://marc.info/?l=oss-security&m=124099284225229&w=2	MLIST	Mailing List Third Party Advisory
4	http://secunia.com/advisories/35226	SECUNIA	Third Party Advisory
5	http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.29.4	CONFIRM	Vendor Advisory
6	http://www.openwall.com/lists/oss-security/2009/05/14/4	MLIST	Mailing List Patch Third Party Advisory
7	http://www.openwall.com/lists/oss-security/2009/05/15/2	MLIST	Mailing List Patch Third Party Advisory
8	http://www.openwall.com/lists/oss-security/2009/05/14/1	MLIST	Mailing List Patch Third Party Advisory
9	http://marc.info/?l=oss-security&m=124099371726547&w=2	MLIST	Mailing List Third Party Advisory
10	http://www.debian.org/security/2009/dsa-1809	DEBIAN	Third Party Advisory
11	http://secunia.com/advisories/35298	SECUNIA	Third Party Advisory
12	https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01271.html	FEDORA	Third Party Advisory
13	http://secunia.com/advisories/35217	SECUNIA	Third Party Advisory
14	http://www.securityfocus.com/bid/34612	BID	Third Party Advisory VDB Entry
15	http://www.mandriva.com/security/advisories?name=MDVSA-2009:148	MANDRIVA	Third Party Advisory
16	http://www.redhat.com/support/errata/RHSA-2009-1157.html	REDHAT	Third Party Advisory
17	http://secunia.com/advisories/36051	SECUNIA	Third Party Advisory
18	http://www.debian.org/security/2009/dsa-1844	DEBIAN	Third Party Advisory
19	http://wiki.rpath.com/Advisories:rPSA-2009-0111	CONFIRM	Broken Link
20	http://secunia.com/advisories/35847	SECUNIA	Third Party Advisory
21	http://secunia.com/advisories/36327	SECUNIA	Third Party Advisory
22	http://www.debian.org/security/2009/dsa-1865	DEBIAN	Third Party Advisory
23	http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html	SUSE	Mailing List Third Party Advisory
24	http://secunia.com/advisories/37351	SECUNIA	Third Party Advisory
25	http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html	SUSE	Mailing List Third Party Advisory
26	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	CONFIRM	Third Party Advisory
27	http://secunia.com/advisories/37471	SECUNIA	Third Party Advisory
28	http://www.vupen.com/english/advisories/2009/3316	VUPEN	Third Party Advisory
29	http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html	SUSE	Mailing List Third Party Advisory
30	http://secunia.com/advisories/35656	SECUNIA	Third Party Advisory
31	http://www.ubuntu.com/usn/usn-793-1	UBUNTU	Third Party Advisory
32	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9525	OVAL	Third Party Advisory
33	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8588	OVAL	Third Party Advisory
34	http://www.securityfocus.com/archive/1/507985/100/0/threaded	BUGTRAQ	Third Party Advisory VDB Entry
35	http://www.securityfocus.com/archive/1/505254/100/0/threaded	BUGTRAQ	Third Party Advisory VDB Entry
36	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=27b87fe52baba0a55e9723030e76fce94fabcea4
37	http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git%3Ba=commit%3Bh=7b0c8fcff47a885743125dd843db64af41af5a61
38	http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git%3Ba=commit%3Bh=968460ebd8006d55661dec0fb86712b40d71c413

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

Linux kernel の CIFS サブシステムにおける Unicode 文字列の処理に関するバッファオーバーフローの脆弱性

Title	Linux kernel の CIFS サブシステムにおける Unicode 文字列の処理に関するバッファオーバーフローの脆弱性
Summary	Linux kernel の CIFS サブシステムには、Unicode 文字列の処理に不備があるため、バッファオーバーフローの脆弱性が存在します。
Possible impacts	リモートの CIFS サーバにより、サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 28, 2009, midnight
Registration Date	Aug. 4, 2009, 11:43 a.m.
Last Update	Feb. 17, 2010, 11:45 a.m.

Affected System

レッドハット

Red Hat Enterprise Linux 4 (as)

Red Hat Enterprise Linux 4 (es)

Red Hat Enterprise Linux 4 (ws)

Red Hat Enterprise Linux 4.8 (as)

Red Hat Enterprise Linux 4.8 (es)

Red Hat Enterprise Linux 5

Red Hat Enterprise Linux 5 (server)

Red Hat Enterprise Linux Desktop 4.0

Red Hat Enterprise Linux Desktop 5.0 (client)

Red Hat Enterprise Linux EUS 5.3.z (server)

サイバートラスト株式会社

Asianux Server 4.0

Asianux Server 4.0 (x86-64)

Linux

Linux Kernel 2.6.29.4 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-1633	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1633
National Vulnerability Database (NVD)
2	CVE-2009-1633	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1633

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Linux Kernel
1	ChangeLog-2.6.29.4	http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.29.4
MIRACLE LINUX アップデート情報
2	1778	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=1778
3	1992	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=1992
Red Hat Security Advisory
4	RHSA-2009:1106	https://rhn.redhat.com/errata/RHSA-2009-1106.html
5	RHSA-2009:1157	https://rhn.redhat.com/errata/RHSA-2009-1157.html
6	RHSA-2009:1211	https://rhn.redhat.com/errata/RHSA-2009-1211.html
レッドハットセキュリティーアップデート
7	RHSA-2009:1106	https://www.jp.redhat.com/support/errata/RHSA/RHSA-2009-1106J.html
8	RHSA-2009:1211	https://www.jp.redhat.com/support/errata/RHSA/RHSA-2009-1211J.html

その他

No	Name	URL
Secunia Advisory
1	SA35107	http://secunia.com/advisories/35107
SecurityFocus
2	34612	http://www.securityfocus.com/bid/34612
3	34989	http://www.securityfocus.com/bid/34989

Change Log

No	Changed Details	Date of change
0	[2009年08月04日] 掲載 [2009年09月16日] 影響を受けるシステム：レッドハット (RHSA-2009:1211) の情報を追加ベンダ情報：レッドハット (RHSA-2009:1211) を追加 [2009年10月16日] 影響を受けるシステム：ミラクル・リナックス (1778) の情報を追加ベンダ情報：ミラクル・リナックス (1778) を追加 [2010年02月17日] ベンダ情報：ミラクル・リナックス (1992) を追加	Feb. 17, 2018, 10:37 a.m.