aboutsummaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2006-11-05 09:04:23 +0100
committerAdrian Bunk <bunk@stusta.de>2006-11-05 09:04:23 +0100
commit0ddfcc96928145d6a6425fdd26dad6abfe7f891d (patch)
tree9fe3f2eb76d7d690fcde2fe000fa0557cda88de7 /include
parent6ac62be885810e1f8390f0c3b9d3ee451d3d3f19 (diff)
[NETFILTER]: Fix ip6_tables extension header bypass bug (CVE-2006-4572)
As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible to a fragmentation attack causing false negatives on extension header matches. When extension headers occur in the non-first fragment after the fragment header (possibly with an incorrect nexthdr value in the fragment header) a rule looking for this extension header will never match. Drop fragments that are at offset 0 and don't contain the final protocol header regardless of the ruleset, since this should not happen normally. Since all extension headers are before the protocol header this makes sure an extension header is either not present or in the first fragment, where we can properly parse it. With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Adrian Bunk <bunk@stusta.de>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions