CVE-2014-1690
published 2014-02-28CVE-2014-1690: The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by…
PriorityP417low2.6CVSS 2.0
AVNACHAuNCPINAN
EPSS
3.85%
89.1th percentile
The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 3.12.8-1 (bookworm) | linux 3.12.8-1 (bookworm) |
| linux | linux_kernel | < 3.12.8 | 3.12.8 |
| linux | linux_kernel | >= 0 < 3.12.8-1 | 3.12.8-1 |
| linux | linux_kernel | >= 0 < 3.12.8-1 | 3.12.8-1 |
| linux | linux_kernel | >= 0 < 3.12.8-1 | 3.12.8-1 |
| linux | linux_kernel | >= 0 < 3.12.8-1 | 3.12.8-1 |
CVSS provenance
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:P/I:N/A:N
osv2.6LOW
vendor_ubuntu5.8MEDIUM
vendor_debian2.6LOW
vendor_redhat2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Raring HWE) vulnerabilities
vendor_ubuntu·2014-04-01·CVSS 5.8
CVE-2013-4345 [MEDIUM] Linux kernel (Raring HWE) vulnerabilities
Title: Linux kernel (Raring HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Stephan Mueller reported an error in the Linux kernel's ansi cprng random
number generator. This flaw makes it easier for a local attacker to break
cryptographic protections. (CVE-2013-4345)
Nico Golde and Fabian Yamaguchi reported buffer underflow errors in the
implementation of the XFS filesystem in the Linux kernel. A local user with
CAP_SYS_ADMIN could exploit these flaw to cause a denial of service (memory
corruption) or possibly other unspecified issues. (CVE-2013-6382)
An information leak was discovered in the Linux kernel when built with the
NetFilter Connection Tracking (NF_CONNTRACK) support for IRC protocol
(NF_NAT_IRC). A remote attacker could exploit this flaw to obt
Ubuntu
Linux kernel (Saucy HWE) vulnerabilities
vendor_ubuntu·2014-03-07·CVSS 2.6
CVE-2014-1690 [LOW] Linux kernel (Saucy HWE) vulnerabilities
Title: Linux kernel (Saucy HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the Linux kernel when built with the
NetFilter Connection Tracking (NF_CONNTRACK) support for IRC protocol
(NF_NAT_IRC). A remote attacker could exploit this flaw to obtain
potentially sensitive kernel information when communicating over a client-
to-client IRC connection(/dcc) via a NAT-ed network. (CVE-2014-1690)
Matthew Thode reported a denial of service vulnerability in the Linux
kernel when SELinux support is enabled. A local user with the CAP_MAC_ADMIN
capability (and the SELinux mac_admin permission if running in enforcing
mode) could exploit this flaw to cause a denial of service (kernel crash).
(CVE-2014-1874)
An information leak was
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-03-07·CVSS 2.6
CVE-2014-1690 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the Linux kernel when built with the
NetFilter Connection Tracking (NF_CONNTRACK) support for IRC protocol
(NF_NAT_IRC). A remote attacker could exploit this flaw to obtain
potentially sensitive kernel information when communicating over a client-
to-client IRC connection(/dcc) via a NAT-ed network. (CVE-2014-1690)
Matthew Thode reported a denial of service vulnerability in the Linux
kernel when SELinux support is enabled. A local user with the CAP_MAC_ADMIN
capability (and the SELinux mac_admin permission if running in enforcing
mode) could exploit this flaw to cause a denial of service (kernel crash).
(CVE-2014-1874)
An information leak was discovered i
Debian
CVE-2014-1690: linux - The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12....
vendor_debian·2014·CVSS 2.6
CVE-2014-1690 [LOW] CVE-2014-1690: linux - The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12....
The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.
Scope: local
bookworm: resolved (fixed in 3.12.8-1)
bullseye: resolved (fixed in 3.12.8-1)
forky: resolved (fixed in 3.12.8-1)
sid: resolved (fixed in 3.12.8-1)
trixie: resolved (fixed in 3.12.8-1)
Red Hat
Kernel: netfilter: nf_nat: leakage of uninitialized buffer in IRC NAT helper
vendor_redhat·2013-12-31·CVSS 2.6
CVE-2014-1690 [LOW] Kernel: netfilter: nf_nat: leakage of uninitialized buffer in IRC NAT helper
Kernel: netfilter: nf_nat: leakage of uninitialized buffer in IRC NAT helper
The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.
Statement: This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
GHSA
GHSA-w8c8-3p33-35r8: The help function in net/netfilter/nf_nat_irc
ghsa_unreviewed·2022-05-13
CVE-2014-1690 [LOW] CWE-200 GHSA-w8c8-3p33-35r8: The help function in net/netfilter/nf_nat_irc
The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.
OSV
CVE-2014-1690: The help function in net/netfilter/nf_nat_irc
osv·2014-02-28·CVSS 2.6
CVE-2014-1690 [LOW] CVE-2014-1690: The help function in net/netfilter/nf_nat_irc
The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.
No detection rules found.
No public exploits indexed.
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2690d97ade05c5325cbf7c72b94b90d265659886http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8http://www.openwall.com/lists/oss-security/2014/01/28/3http://www.ubuntu.com/usn/USN-2137-1http://www.ubuntu.com/usn/USN-2140-1http://www.ubuntu.com/usn/USN-2158-1https://bugzilla.redhat.com/show_bug.cgi?id=1058748https://github.com/torvalds/linux/commit/2690d97ade05c5325cbf7c72b94b90d265659886http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2690d97ade05c5325cbf7c72b94b90d265659886http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8http://www.openwall.com/lists/oss-security/2014/01/28/3http://www.ubuntu.com/usn/USN-2137-1http://www.ubuntu.com/usn/USN-2140-1http://www.ubuntu.com/usn/USN-2158-1https://bugzilla.redhat.com/show_bug.cgi?id=1058748https://github.com/torvalds/linux/commit/2690d97ade05c5325cbf7c72b94b90d265659886
2014-02-28
Published