LinuxKernel multiple IPv6 packet bypass filtering vulnerability

Multiple IPv6 packet bypass filtering vulnerabilities in LinuxKernel-Linux general technology-Linux programming and kernel information. Read the following for details. Affected Systems:

Linux kernel <2.6.16.31

Description:

Linux Kernel is the Kernel used by open source Linux.

Linux Kernel netfilter has a vulnerability in processing IPv6 packets. Remote attackers may exploit this vulnerability to bypass firewall filtering.

Linux Kernel's netfilter does not properly process some fragments of IPv6 packets. If the part header is not a protocol header after the part header in the message, the part header will contain the Protocol Number of the next extension header. If the extension header and protocol header are sent in the second Shard, the rules similar to "ip6tables...-p udp-j DROP" cannot be matched.

In addition, if the extension header appears not in the first shard after the fragment header (the fragment header may contain incorrect nexthdr values), it cannot match the search rule for this extension header.

<* Source: Marc Dowd (Mark_Dowd@McAfee.com)

Link: http://secunia.com/advisories/22731/

Http://www.kernel.org/git? P = lin... d381634d213580d40d4

Http://www.kernel.org/git? P = lin... 1d8b1a65291a6956b79

*>

Suggestion:

Vendor patch:

Linux

The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.kernel.org/pub/linux/... atch-2.6.19-rc4.bz2