CVE-2006-3121 : The peel_netstring function in cl_netstring.c in the heartbeat subsystem in High

The peel_netstring function in cl_netstring.c in the heartbeat subsystem in High-Availability Linux before 1.2.5, and 2.0 before 2.0.7, allows remote attackers to cause a denial of service (crash) via the length parameter in a heartbeat message.

Published 2006-08-17 01:04:00

Updated 2017-07-20 01:32:04

Source Debian GNU/Linux

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2006-3121

High Availability Linux Project » Heartbeat » Version: 1.2.3
cpe:2.3:a:high_availability_linux_project:heartbeat:1.2.3:*:*:*:*:*:*:*
Matching versions
High Availability Linux Project » Heartbeat » Version: 2.0.2
cpe:2.3:a:high_availability_linux_project:heartbeat:2.0.2:*:*:*:*:*:*:*
Matching versions
High Availability Linux Project » Heartbeat » Version: 2.0.3
cpe:2.3:a:high_availability_linux_project:heartbeat:2.0.3:*:*:*:*:*:*:*
Matching versions
High Availability Linux Project » Heartbeat » Version: 2.0.4
cpe:2.3:a:high_availability_linux_project:heartbeat:2.0.4:*:*:*:*:*:*:*
Matching versions
High Availability Linux Project » Heartbeat » Version: 2.0.5
cpe:2.3:a:high_availability_linux_project:heartbeat:2.0.5:*:*:*:*:*:*:*
Matching versions
High Availability Linux Project » Heartbeat » Version: 2.0.6
cpe:2.3:a:high_availability_linux_project:heartbeat:2.0.6:*:*:*:*:*:*:*
Matching versions
High Availability Linux Project » Heartbeat » Version: 1.2.4
cpe:2.3:a:high_availability_linux_project:heartbeat:1.2.4:*:*:*:*:*:*:*
Matching versions
High Availability Linux Project » Heartbeat » Version: 2.0.1
cpe:2.3:a:high_availability_linux_project:heartbeat:2.0.1:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2006-3121

EPSS FAQ

11.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 95 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2006-3121

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial

CWE ids for CVE-2006-3121

CWE-399

Assigned by: nvd@nist.gov (Primary)

References for CVE-2006-3121

https://exchange.xforce.ibmcloud.com/vulnerabilities/28396

Linux-HA Heartbeat packet denial of service CVE-2006-3121 Vulnerability Report
http://www.linux-ha.org/_cache/SecurityIssues__sec03.txt

CVEs referencing this url
http://www.linux-ha.org/SecurityIssues

Patch
http://www.securityfocus.com/bid/19516

Patch
http://www.vupen.com/english/advisories/2006/3288

Site en construction
Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:142

Mandriva

CVEs referencing this url
http://security.gentoo.org/glsa/glsa-200608-23.xml

Heartbeat: Denial of service (GLSA 200608-23) — Gentoo security

CVEs referencing this url
http://www.debian.org/security/2006/dsa-1151

[SECURITY] [DSA 1151-1] New heartbeat packages fix denial of service
Patch
http://www.ubuntu.com/usn/usn-335-1

USN-335-1: heartbeat vulnerability | Ubuntu security notices | Ubuntu

Jump to

Vulnerability Details : CVE-2006-3121

Products affected by CVE-2006-3121

Exploit prediction scoring system (EPSS) score for CVE-2006-3121

CVSS scores for CVE-2006-3121

CWE ids for CVE-2006-3121

References for CVE-2006-3121