SB2001070701 - Resource exhaustion in Linux kernel

Description

This security bulletin contains information about 1 vulnerability.

1) Resource exhaustion (CVE-ID: CVE-2001-1244)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Multiple TCP implementations could allow remote attackers to cause a denial of service (bandwidth and CPU exhaustion) by setting the maximum segment size (MSS) to a very small number and requesting large amounts of data, which generates more packets with less TCP-level data that amplify network traffic and consume more server CPU to process.

Remediation

Install update from vendor's website.

References

• http://www.securityfocus.com/archive/1/195457
• http://www.securityfocus.com/bid/2997
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6824