[Full-disclosure] [MU-200605-01] Multiple vulnerabilities in Linux SCTP 2.6.16

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Multiple vulnerabilities in Linux SCTP 2.6.16 [MU-200605-01]
May 8, 2006

http://labs.musecurity.com/advisories.html

Affected Product/Versions:

Linux SCTP 2.6.16 [http://lksctp.sourceforge.net]

Product Overview:

The Linux Kernel Stream Control Transmission Protocol (lksctp) project is an
implementation of the Stream Control Transmission Protocol (SCTP) in the Linux
kernel. The primary goal of this project is to provide user applications with
a viable SCTP solution.

Vulnerability Details:

Multiple vulnerabilities exist in Linux SCTP 2.6.16 (lksctp) all resulting in
kernel panics. The crafted packets must be sent to a listening endpoint in
order to exploit these vulnerabilities.

The first vulnerablity triggered by ECNE chunks is due to the use of incorrect
state table entries for certain CHUNKS received in CLOSED state. Since this
vulnerability does not require a full 'session' to be established, the source
IP address may be spoofed resulting in a single packet triggering the panic.

The second vulnerability is triggered due to a bug in handling incoming IP
fragmented SCTP control chunks. This causes a kernel BUG in skb_pull.

Vendor Response / Solution:

All users of Linux SCTP are recommended to upgrade to 2.6.17 which fixes
these problems.

Hotfix solution to this advisory:

Patches for these two vulnerabilities are available from the following links:

http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=35d63edb1c807bc5317e49592260e84637bc432e
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=62b08083ec3dbfd7e533c8d230dd1d8191a6e813

Mu Security would like to thank the Linux SCTP team in advance for timely
remediation of these vulnerabilities.

Credit:

This vulnerability was discovered by the Mu Security research team.

http://labs.musecurity.com/pgpkey.txt

Mu Security is an early-stage innovator creating a new class of security
analysis system. The company's mission is to widely deploy security analysis
and reduce product and application vulnerabilities. Mu's founders include
industry-recognized experts in the IDP, open source protocol analysis tools,
ethical hacking, and network management markets. The security analysis process
and product solution provide a rigorous and streamlined methodology for
verifying and improving the security readiness of any IP-based product or
application. Mu Security, headquartered in Sunnyvale, California, is backed
by preeminent venture capital firms including Accel Partners and Benchmark
Capital.

The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There are no
warranties, implied or express, with regard to this information. In no event
shall the author be liable for any direct or indirect damages whatsoever
arising out of or in connection with the use or spread of this information.
Any use of this information is at the user's own risk.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (Darwin)

iD8DBQFEX48vMl+docYeP+YRAnwtAJ955MaoL9VqEZf2rii77pwvxFdW0wCfUnGY
zvQs8yldRZLPzef9D9JyR4Y=
=WO2x
-----END PGP SIGNATURE-----

---

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/