CVE-2008-4609

Bsd < 12.2\(50\) - Denial of Service

Title source: rule

Description

The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.

Exploits (1)

nomisec WORKING POC 17 stars

by mrclki · poc

https://github.com/mrclki/sockstress

View Code ZIP pw:eip

References (15)

[Broken Link] http://blog.robertlee.name/2008/10/conjecture-speculation.html

[Broken Link] http://insecure.org/stf/tcp-dos-attack-explained.html

[Broken Link] http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html

[Third Party Advisory] http://marc.info/?l=bugtraq&m=125856010926699&w=2

[Broken Link] http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked

[Broken Link] http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml

[Broken Link] http://www.cisco.com/en/US/products/products_security_response09186a0080a15120.html

[Broken Link] http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf

[Broken Link] http://www.mandriva.com/security/advisories?name=MDVSA-2013:150

[Third Party Advisory] http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html

[Broken Link] http://www.outpost24.com/news/news-2008-10-02.html

[Third Party Advisory, US Government Resource] http://www.us-cert.gov/cas/techalerts/TA09-251A.html

[Patch, Third Party Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048

[Broken Link] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6340

[Broken Link] https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html

Scores

EPSS 0.0188

EPSS Percentile 82.9%

Classification

CWE

CWE-16

Status draft

Affected Products (50)

bsd/bsd

bsd/bsd

bsd/bsd

bsd/bsd

bsd/bsd

bsdi/bsd_os

bsdi/bsd_os

bsdi/bsd_os

bsdi/bsd_os

bsdi/bsd_os

bsdi/bsd_os

bsdi/bsd_os

bsdi/bsd_os

bsdi/bsd_os

bsdi/bsd_os

... and 35 more

Timeline

Published Oct 20, 2008

Tracked Since Feb 18, 2026