CVE-2006-3202 Denial of service in n/a
Local attackers can crash the system by sending IPv4 packets through IPv4-mapped IPv6 sockets with specific options enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-3202?
CVE-2006-3202 is a medium-severity denial of service vulnerability in Netbsd Netbsd, published on 23 Jun 2006. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The ip6_savecontrol function in NetBSD 2.0 through 3.0, under certain configurations, does not check to see if IPv4-mapped sockets are being used before processing IPv6 socket options, which allows local users to cause a denial of service (crash) by creating an IPv4-mapped IPv6 socket with the SO_TIMESTAMP socket option set, then sending an IPv4 packet through the socket.
Which versions are affected by CVE-2006-3202?
It affects 1 product.
Products include Netbsd Netbsd.
How do I fix CVE-2006-3202?
No fix has been published for CVE-2006-3202 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2006-3202 being exploited?
There is no known exploitation of CVE-2006-3202 in the wild and no public exploit code.
Other vulnerabilities in Netbsd Netbsd
Sources
Also known as GHSA-vj6j-x8fq-xj4j.