Vulnerability Details : CVE-2008-3526
Integer overflow in the sctp_setsockopt_auth_key function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel 2.6.24-rc1 through 2.6.26.3 allows remote attackers to cause a denial of service (panic) or possibly have unspecified other impact via a crafted sca_keylength field associated with the SCTP_AUTH_KEY option.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2008-3526
- cpe:2.3:o:linux:linux_kernel:2.6.24:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.24:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.24.1:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.24:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.11:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.12:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.2:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.9:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.26:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.24.6:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.24.7:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.1:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.10:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.7:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.8:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.24.4:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.24.5:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.15:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.5:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.6:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.26.3:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.24.2:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.24.3:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.13:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.14:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.3:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.25.4:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.26.1:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.26.2:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.24_rc1:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.24_rc4:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.24_rc5:*:*:*:*:*:*:*
Threat overview for CVE-2008-3526
Top countries where our scanners detected CVE-2008-3526
Top open port discovered on systems with this issue
49152
IPs affected by CVE-2008-3526 540
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2008-3526!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2008-3526
8.81%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2008-3526
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |
10.0
|
6.9
|
NIST |
CWE ids for CVE-2008-3526
-
Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2008-3526
-
Red Hat 2009-01-15This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and 5. It was addressed in Red Hat Enterprise MRG for RHEL-5 via: https://rhn.redhat.com/errata/RHSA-2008-0857.html
References for CVE-2008-3526
-
http://www.mandriva.com/security/advisories?name=MDVSA-2008:223
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/44723
-
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git%3Ba=commit%3Bh=30c2235cbc477d4629983d440cdc4f496fec9246
-
http://www.openwall.com/lists/oss-security/2008/08/26/9
-
http://www.debian.org/security/2008/dsa-1636
-
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00010.html
-
http://www.ubuntu.com/usn/usn-659-1
-
http://www.redhat.com/support/errata/RHSA-2008-0857.html
-
http://www.securityfocus.com/bid/30847
Jump to