CVE-2013-2017
published 2013-05-03CVE-2013-2017: The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion, which allows remote attackers to…
PriorityP335high7.8CVSS 2.0
AVNACLAuNCNINAC
EPSS
4.19%
89.9th percentile
The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion, which allows remote attackers to cause a denial of service (system crash) by leveraging lack of skb consumption in conjunction with a double-free error.
Affected
42 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 2.6.34-1 (bookworm) | linux 2.6.34-1 (bookworm) |
| linux | linux_kernel | <= 2.6.33.20 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 2.6.34-1 | 2.6.34-1 |
| linux | linux_kernel | >= 0 < 2.6.34-1 | 2.6.34-1 |
| linux | linux_kernel | >= 0 < 2.6.34-1 | 2.6.34-1 |
CVSS provenance
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.8HIGH
cisa7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_msrc5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m9r4-3v2g-qcj7: The veth (aka virtual Ethernet) driver in the Linux kernel before 2
ghsa_unreviewed·2022-05-14
CVE-2013-2017 [HIGH] GHSA-m9r4-3v2g-qcj7: The veth (aka virtual Ethernet) driver in the Linux kernel before 2
The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion, which allows remote attackers to cause a denial of service (system crash) by leveraging lack of skb consumption in conjunction with a double-free error.
Kernel
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
kernel_security·2018-09-25·CVSS 7.1
CVE-2013-4348 [HIGH] Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
Daniel Borkmann says:
pull-request: bpf-next 2018-09-25
The following pull-request contains BPF updates for your *net-next* tree.
The main changes are:
1) Allow for RX stack hardening by implementing the kernel's flow
dissector in BPF. Idea was originally presented at netconf 2017 [0].
Quote from merge commit:
[...] Because of the rigorous checks of the BPF verifier, this
provides significant security guarantees. In particular, the BPF
flow dissector cannot get inside of an infinite loop, as with
CVE-2013-4348, because BPF programs are guaranteed to terminate.
It cannot read outside of packet bounds, because all memory accesses
are checked. Also, with BPF the administrator can decide which
protocols to support, reducing
OSV
CVE-2013-2017: The veth (aka virtual Ethernet) driver in the Linux kernel before 2
osv·2013-05-03·CVSS 7.8
CVE-2013-2017 [HIGH] CVE-2013-2017: The veth (aka virtual Ethernet) driver in the Linux kernel before 2
The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion, which allows remote attackers to cause a denial of service (system crash) by leveraging lack of skb consumption in conjunction with a double-free error.
CISA
Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability
cisa·2022-03-03·CVSS 7.8
CVE-2017-8540 [HIGH] CWE-119 Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability
Vulnerability: Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability
Affected: Microsoft Malware Protection Engine
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-8540
Remediation Due Date: 2022-03-24
Microsoft
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. Th
vendor_msrc·2017-10-10·CVSS 5.9
CVE-2017-15042 [MEDIUM] CWE-319 An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. Th
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits t
Red Hat
golang: smtp.PlainAuth susceptible to man-in-the-middle password harvesting
vendor_redhat·2017-10-04·CVSS 5.9
CVE-2017-15042 [MEDIUM] CWE-300 golang: smtp.PlainAuth susceptible to man-in-the-middle password harvesting
golang: smtp.PlainAuth susceptible to man-in-the-middle password harvesting
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
It was found that smtp.PlainAuth authentication scheme in Go did not verify the TLS requirement
Microsoft
Windows PDF Remote Code Execution Vulnerability
vendor_msrc·2017-06-13·CVSS 3.6
CVE-2017-0292 [HIGH] Windows PDF Remote Code Execution Vulnerability
Windows PDF Remote Code Execution Vulnerability
Description: A remote code execution vulnerability exists in Microsoft Windows, Microsoft Word 2013 and Microsoft Word 2016 if a user opens a specially crafted PDF file. An attacker who successfully exploited the vulnerability could cause arbitrary code to execute in the context of the current user.
To exploit the vulnerability, an attacker must entice the user to open a specially crafted PDF file.
The update addresses the vulnerability by modifying how Windows and Microsoft Word parse PDF files.
Microsoft Windows PDF: Microsoft Windows PDF
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:Temporary
Referenc
Red Hat
grub2: Stack exhaustion in grub_ext2_read_block
vendor_redhat·2017-06-11·CVSS 7.5
CVE-2017-9763 [HIGH] CWE-400 grub2: Stack exhaustion in grub_ext2_read_block
grub2: Stack exhaustion in grub_ext2_read_block
The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote attackers to cause a denial of service (excessive stack use and application crash) via a crafted binary file, related to use of a variable-size stack array.
Package: grub (Red Hat Enterprise Linux 5) - Not affected
Package: grub (Red Hat Enterprise Linux 6) - Not affected
Package: grub2 (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2013-2017: linux - The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does no...
vendor_debian·2013·CVSS 7.8
CVE-2013-2017 [HIGH] CVE-2013-2017: linux - The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does no...
The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion, which allows remote attackers to cause a denial of service (system crash) by leveraging lack of skb consumption in conjunction with a double-free error.
Scope: local
bookworm: resolved (fixed in 2.6.34-1)
bullseye: resolved (fixed in 2.6.34-1)
forky: resolved (fixed in 2.6.34-1)
sid: resolved (fixed in 2.6.34-1)
trixie: resolved (fixed in 2.6.34-1)
Red Hat
kernel: veth: double-free flaw in case of congestion
vendor_redhat·2010-05-06·CVSS 7.8
CVE-2013-2017 [HIGH] kernel: veth: double-free flaw in case of congestion
kernel: veth: double-free flaw in case of congestion
The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion, which allows remote attackers to cause a denial of service (system crash) by leveraging lack of skb consumption in conjunction with a double-free error.
Statement: This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: realtime-kernel (Red Hat Enterprise MRG 2) - Not affected
No detection rules found.
Exploit-DB
Fifthplay S.A.M.I 2019.2_HP - Persistent Cross-Site Scripting
exploitdb·2020-01-29
Fifthplay S.A.M.I 2019.2_HP - Persistent Cross-Site Scripting
Fifthplay S.A.M.I 2019.2_HP - Persistent Cross-Site Scripting
---
# Exploit Title: Fifthplay S.A.M.I 2019.2_HP - Persistent Cross-Site Scripting
# Date: 2020-01-29
# Exploit Author: LiquidWorm
# Vendor: Fifthplay NV
# Vendor Homepage: https://www.fifthplay.com
# Version: 2019.2_HP
# Tested on: Linux
# CVE : -
Fifthplay S.A.M.I - Service And Management Interface Unauthenticated Stored XSS
Vendor: Fifthplay NV
Product web page: https://www.fifthplay.com
Affected version: Platform: HAM V1.2
HAM V1.1
HAM V1.0
DINHAM 10W
Image Version: 2019.3-20190605144803
2019.2_HP-20190808154634
2018.4_HP-20181015152950
2018.2-20180516100815
2017.2_HP-20180213083050
2013.4_HP-201309301203
AMP Version: 2019.2_HP
2018.4_HP
2017.2_HP
2013.4_HP
R20.19.03
R20.18.02
Fix: 2017.2-HP4
2018.4_HP3
2018.5_HP7
2019.
Exploit-DB
Microsoft Excel - OLE Arbitrary Code Execution
exploitdb·2017-09-30
CVE-2017-0199 Microsoft Excel - OLE Arbitrary Code Execution
Microsoft Excel - OLE Arbitrary Code Execution
---
Title: MS Office Excel (all versions) Arbitrary Code Execution Vulnerability
Date: September 30th, 2017.
Author: Eduardo Braun Prado
Vendor Homepage: http://www.microsoft.com/
Software Link: https://products.office.com/
Version: 2007,2010,2013,2016 32/64 bits (x86 and x64)
Tested on: Windows 10/8.1/8.0/7/Server 2012/Server 2008/Vista (X86 and x64)
CVE: 2017-0199
Description:
MS Excel contains a remote code execution vulnerability upon processing OLE objects. Although this is a different issue from the
MS Word HTA execution vulnerability, it has been patched together, 'silently'. By performing some tests from the Word HTA PoC posted
on exploit-db[dot]com, it´s possible to exploit it through Excel too, however the target would ne
Exploit-DB
Skype for Business 2016 - Cross-Site Scripting
exploitdb·2017-07-12·CVSS 5.4
CVE-2017-8550 [MEDIUM] Skype for Business 2016 - Cross-Site Scripting
Skype for Business 2016 - Cross-Site Scripting
---
# Exploit Title: Skype for Business 2016 XSS Injection - CVE-2017-8550
#
# Exploit Author: @nyxgeek - TrustedSec
# Date: 2017-04-10
# Vendor Homepage: www.microsoft.com
# Versions: 16.0.7830.1018 32-bit & 16.0.7927.1020 64-bit or lower
#
#
# Requirements: Originating machine needs Lync 2013 SDK installed as well as a user logged
# into the Skype for Business client locally
#
#
# Description:
#
# XSS injection is possible via the Lync 2013 SDK and PowerShell. No user-interaction is
# required for the XSS to execute on the target machine. It will run regardless of whether
# or not they accept the message. The target only needs to be online.
#
# Additionally, by forcing a browse to a UNC path via the file URI it is possible to
# capture has
Exploit-DB
OXID eShop < 4.7.11/5.0.11 / < 4.8.4/5.1.4 - Multiple Vulnerabilities
exploitdb·2014-03-20·CVSS 4.3
CVE-2014-2017 [MEDIUM] OXID eShop < 4.7.11/5.0.11 / < 4.8.4/5.1.4 - Multiple Vulnerabilities
OXID eShop < 4.7.11/5.0.11 / < 4.8.4/5.1.4 - Multiple Vulnerabilities
---
# Exploit Title: OXID eShop v<4.7.11/5.0.11 + v<4.8.4/5.1.4 Multiple Vulnerabilities
# Google Dork: -
# Date: 12/2013
# Exploit Author: //sToRm
# Author mail: [email protected]
# Vendor Homepage: http://www.oxid-esales.com
# Software Link: -
# Version: All versions < 4.7.11/5.0.11 + All versions < 4.8.4/5.1.4
# Tested on: Multiple platforms
# CVE : CVE-2014-2016 + CVE-2014-2017 (reserved)
###########################################################################################################
# XSS vulnerability #######################################################################################
Under certain circumstances, an attacker can trick a user to enter a specially crafted
URI or click on
Bugzilla
CVE-2017-9763 grub2: Stack exhaustion in grub_ext2_read_block
bugzilla·2017-06-20·CVSS 7.5
CVE-2017-9763 [HIGH] CVE-2017-9763 grub2: Stack exhaustion in grub_ext2_read_block
CVE-2017-9763 grub2: Stack exhaustion in grub_ext2_read_block
The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote attackers to cause a denial of service (excessive stack use and application crash) via a crafted binary file, related to use of a variable-size stack array.
Upstream patch:
https://git.savannah.gnu.org/cgit/grub.git/commit/grub-core/fs/ext2.c?id=ac8cac1dac50daaf1c390d701cca3b55e16ee768
Discussion:
This issue did not affect the versions of grub as shipped with Red Hat Enterprise Linux 5 and 6 as they did not contain affected function. This issue did not affect the versions of grub2 as shipped with Red Hat Enterprise Linux 7 as the patch is in place.
Bugzilla
CVE-2017-2659 dropbear: Information leak when given invalid username
bugzilla·2017-03-20·CVSS 5.3
CVE-2017-2659 [MEDIUM] CVE-2017-2659 dropbear: Information leak when given invalid username
CVE-2017-2659 dropbear: Information leak when given invalid username
It was found that dropbear with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts.
This was fixed in dropbear-2013.59, as part of the following patch:
https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409a#l1.86
Discussion:
Acknowledgments:
Name: Gilford Martino (Bae Systems), Scott McKee (Bae Systems)
---
External References:
https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409a#l1.86
Bugzilla
CVE-2013-5653 ghostscript: getenv and filenameforall ignore -dSAFER
bugzilla·2016-09-29·CVSS 5.5
CVE-2013-5653 [MEDIUM] CVE-2013-5653 ghostscript: getenv and filenameforall ignore -dSAFER
CVE-2013-5653 ghostscript: getenv and filenameforall ignore -dSAFER
It was found that getenv and filenameforall ignore -dSAFER possibly allowing filesystem enumeration.
Upstream bug:
http://bugs.ghostscript.com/show_bug.cgi?id=694724
Upstream patch:
http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=ab109aaeb3ddba59518b036fb288402a65cf7ce8
Reference:
http://seclists.org/oss-sec/2016/q3/651
Reproducer:
%!PS
(HOME) getenv { print (\n) print } { (variable not found\n) print } ifelse
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1390486]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2017:0014 https://rhn.redhat.com/errata/RHSA-2017-0014.html
---
This issue has been addressed in the
Bugzilla
CVE-2013-2017 kernel: veth: double-free flaw in case of congestion
bugzilla·2013-04-29·CVSS 7.8
CVE-2013-2017 [HIGH] CVE-2013-2017 kernel: veth: double-free flaw in case of congestion
CVE-2013-2017 kernel: veth: double-free flaw in case of congestion
A flaw was found in the way Virtual Ethernet driver implementation in the Linux kernel handled skbs in case of congestion.
A remote attacker could potentially use this flaw to crash the system.
Introduced in:
2.6.33-rc1
Fixed in:
2.6.34
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6ec82562ffc6f297d0de36d65776cff8e5704867
References:
http://marc.info/?l=linux-netdev&m=127310770900442&w=3
Acknowledgements:
Red Hat would like to thank Atzm WATANABE of Stratosphere Inc. for reporting this issue.
Discussion:
Statement:
This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.
---
This issue has been add
http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6ec82562ffc6f297d0de36d65776cff8e5704867http://www.openwall.com/lists/oss-security/2013/04/29/10https://bugzilla.redhat.com/show_bug.cgi?id=957705https://github.com/torvalds/linux/commit/6ec82562ffc6f297d0de36d65776cff8e5704867https://support.f5.com/csp/article/K39655464http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6ec82562ffc6f297d0de36d65776cff8e5704867http://www.openwall.com/lists/oss-security/2013/04/29/10https://bugzilla.redhat.com/show_bug.cgi?id=957705https://github.com/torvalds/linux/commit/6ec82562ffc6f297d0de36d65776cff8e5704867https://support.f5.com/csp/article/K39655464
2013-05-03
Published