Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Preemptive Protection againt Linux Kernel SNMP NAT Netfilter Memory Corruption Vulnerability

Subscribe

Check Point Reference: CPAI-2008-104
Date Published:
Severity:
Source: Secunia Advisory: SA20225
Industry Reference(s): CVE-2006-2444
Protection Provided by: IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Linux Kernel Project Kernel 2.6.16.17 and earlier
Vulnerability Description
A denial of service vulnerability has been discovered in the Linux Kernel. Linux is a popular open-source operating system. The Linux kernel supports a packet filtering framework known as Netfilter. Netfilter is capable of processing various IP based protocols, including SNMP. A remote attacker may exploit the vulnerability via a malformed SNMP packet.
Update/Patch Available
Update to version 2.6.16.18:
Kernel
Vulnerability Details
The vulnerability is due to insufficient checks of the Netfilter when processing SNMP packets. A remote attacker can exploit this issue by sending a specially crafted SNMP packet to a target host. Successful exploitation of this vulnerability may allow the attacker to cause a double free error in the Linux Kernel, creating a denial of service condition.

Protection Overview
By enabling this protection, IPS-1 will detect and block malformed SNMP packets. No update is required to address this vulnerability.

Users are protected against this vulnerability if the protection against Malformed SNMP Packets has been applied.

To configure the defense, select your product from the list below and follow the related protection steps.

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Network Security > SNMP, and select the SNMP Attacks protection group.
3. Click Malformed SNMP packet (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entry will be logged:

Alert Name: snmp_attacks
Description: malformed_packet_alert