CVE-2012-2663 — Iptables vulnerability

8 documents7 sources

Severity

7.5HIGHNVD

EPSS

0.4%

top 41.70%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Netfilter Iptables

Timeline

PublishedFeb 15

Latest updateMay 13

Description

extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. NOTE: the CVE-2012-6638 fix makes this issue less relevant.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDnetfilter/iptables1.4.21

Patches

Patch: www.spinics.net ↗Patch: bugzilla.redhat.com ↗Patch: www.spinics.net ↗

🔴Vulnerability Details

GHSA

GHSA-g725-p8m6-82j4: extensions/libxt_tcp↗2022-05-13

▶

OSV

CVE-2012-2663: extensions/libxt_tcp↗2014-02-15

▶

CVEList

CVE-2012-2663: extensions/libxt_tcp↗2014-02-15

▶

📋Vendor Advisories

Debian

CVE-2012-2663: iptables - extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN pac...↗2012

▶

Red Hat

iptables: --syn flag bypass↗2011-12-02

▶

Red Hat

Kernel: net: tcp: potential DoS via SYN+FIN messages↗2011-12-02

▶

💬Community

Bugzilla

CVE-2012-2663 iptables: --syn flag bypass↗2012-05-30

▶