Vulnerability CVE-2004-0002 - CERT Civis.Net

Vulnerability Name:

CVE-2004-0002 (CCN-6824)

Assigned:

2001-07-08

Published:

2001-07-08

Updated:

2008-09-10

Summary:

The TCP MSS (maximum segment size) functionality in netinet allows remote attackers to cause a denial of service (resource exhaustion) via (1) a low MTU, which causes a large number of small packets to be produced, or (2) via a large number of packets with a small TCP payload, which cause a large number of calls to the resource-intensive sowakeup function.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Denial of Service

References:

Source: CCN
Type: BugTraq Mailing List, Sat Jul 07 2001 - 10:47:21 CDT
Small TCP packets == very large overhead == DoS?

Source: CCN
Type: BugTraq Mailing List, Sun Jul 08 2001 - 06:30:57 CDT
Re: Small TCP packets == very large overhead == DoS?

Source: CCN
Type: BugTraq Mailing List, Mon Jul 09 2001 - 10:49:37 CDT
RE: Small TCP packets == very large overhead == DoS?

Source: CCN
Type: BugTraq Mailing List, Mon Jul 09 2001 - 11:23:22 CDT
RE: Small TCP packets == very large overhead == DoS?

Source: CCN
Type: BugTraq Mailing List, Mon Jul 09 2001 - 18:30:10 CDT
Re: Small TCP packets == very large overhead == DoS?

Source: MITRE
Type: CNA
CVE-2001-1244

Source: MITRE
Type: CNA
CVE-2004-0002

Source: CCN
Type: cvs commit: src/sys/netinet ip_icmp.c tcp.h tcp_input.c tcp_subr.c tcp_usrreq.c tcp_var.h
cvs commit: src/sys/netinet ip_icmp.c tcp.h tcp_input.c tcp_subr.c tcp_usrreq.c tcp_var.h

Source: CONFIRM
Type: Patch, Vendor Advisory
http://lists.freebsd.org/pipermail/cvs-src/2004-January/016271.html

Source: CCN
Type: OSVDB ID: 10385
Multiple TCP Implementation Mismatched MSS DoS

Source: CCN
Type: OSVDB ID: 6854
netinet TCP MSS Resource Exhaustion DoS

Source: CCN
Type: BID-2997
Multiple Vendor Small TCP MSS Denial of Service Vulnerability

Source: CCN
Type: BID-9572
FreeBSD NetINet TCP Maximum Segment Size Remote Denial Of Service Vulnerability

Source: XF
Type: UNKNOWN
tcp-mss-dos(6824)

Vulnerable Configuration:

Configuration 1:

cpe:/o:freebsd:freebsd:3.0:*:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:3.0:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:3.1:*:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:3.2:*:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:3.3:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:3.4:*:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:3.5:*:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:3.5:stable:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:3.5.1:*:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:3.5.1:release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:3.5.1:stable:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.0:*:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.0:alpha:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.0:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.1:*:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.1.1:*:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.1.1:release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.1.1:stable:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.2:*:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.2:stable:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.3:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.3:release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.3:release_p38:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.3:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.3:stable:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.4:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.4:release_p42:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.4:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.4:stable:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.5:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.5:release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.5:release_p32:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.5:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.5:stable:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.6:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.6:release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.6:release_p20:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.6:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.6:stable:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.6.2:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.7:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.7:release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.7:release_p17:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.7:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.7:stable:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.8:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.8:pre-release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.8:release_p6:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.8:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.9:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:4.9:pre-release:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.0:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.0:alpha:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.0:release_p14:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.0:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.1:-:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.1:release_p5:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.1:releng:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:5.2:-:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:linux:linux_kernel:*:*:*:*:*:*:*:*

OR cpe:/o:freebsd:freebsd:*:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.5.1:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:11.00:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:*:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2000:*:*:*:*:*:*:*:*

OR cpe:/o:openbsd:openbsd:*:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.8:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:11.04:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:11.11:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:11.20:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:11.22:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:11.23:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.7:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:11.11i:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:11.31:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:11.0.4:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:11.10:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:11.2:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:11.4:*:*:*:*:*:*:*

Denotes that component is vulnerable