Vulnerability Details : CVE-2009-2903
Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddp"N" device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams.
Vulnerability category: Denial of service
Products affected by CVE-2009-2903
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:10:sp3:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp2:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp3:*:*:*:*:*:*
- cpe:2.3:a:suse:linux_enterprise_debuginfo:10:sp2:*:*:*:*:*:*
- cpe:2.3:a:suse:linux_enterprise_debuginfo:10:sp3:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
Threat overview for CVE-2009-2903
Top countries where our scanners detected CVE-2009-2903
Top open port discovered on systems with this issue
49152
IPs affected by CVE-2009-2903 1,155
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2009-2903!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2009-2903
3.19%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 91 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-2903
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.1
|
HIGH | AV:N/AC:M/Au:N/C:N/I:N/A:C |
8.6
|
6.9
|
NIST |
CWE ids for CVE-2009-2903
-
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2009-2903
-
Red Hat 2009-09-17Red Hat is aware of this issue. Please see http://kbase.redhat.com/faq/docs/DOC-19077 This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5, as the affected driver is not enabled in these kernels. The affected driver is available in Red Hat Enterprise MRG. It is also available in Red Hat Enterprise Linux 3, but only if the kernel-unsupported package is installed. Future kernel updates in Red Hat Enterprise Linux 3 and Red Hat Enterprise MRG will address this issue.
References for CVE-2009-2903
-
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html
[security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:20Mailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html
[security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:2009:064) - openSUSE Security Announce - openSUSE Mailing ListsMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.html
[security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:20Mailing List;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2009/09/14/1
Mailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/36379
Third Party Advisory;VDB Entry
-
http://www.ubuntu.com/usn/USN-852-1
USN-852-1: Linux kernel vulnerabilities | Ubuntu security notices | UbuntuThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html
[security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:2009:061) - openSUSE Security Announce - openSUSE Mailing ListsMailing List;Third Party Advisory
-
http://git.kernel.org/?p=linux/kernel/git/davem/net-next-2.6.git%3Ba=commit%3Bh=ffcfb8db540ff879c2a85bf7e404954281443414
-
https://bugzilla.redhat.com/show_bug.cgi?id=522331
Issue Tracking;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2009/09/17/11
Mailing List;Third Party Advisory
-
http://www.mandriva.com/security/advisories?name=MDVSA-2009:329
MandrivaThird Party Advisory
-
http://www.openwall.com/lists/oss-security/2009/09/14/2
Mailing List;Third Party Advisory
Jump to