CVE-2013-5209 Information disclosure in n/a
Remote attackers can read sensitive kernel stack memory via SCTP INIT-ACK chunks due to improper initialization in the FreeBSD kernel.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-5209?
CVE-2013-5209 is a high-severity vulnerability in Freebsd Freebsd, published on 29 Aug 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The sctp_send_initiate_ack function in sys/netinet/sctp_output.c in the SCTP implementation in the kernel in FreeBSD 8.3 through 9.2-PRERELEASE does not properly initialize the state-cookie data structure, which allows remote attackers to obtain sensitive information from kernel stack memory by reading packet data in INIT-ACK chunks.
Weakness: CWE-200
Which versions are affected by CVE-2013-5209?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2013-5209?
Apply the vendor's patch.
Is CVE-2013-5209 being exploited?
There is no known exploitation of CVE-2013-5209 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as GHSA-2r3m-qf73-j4jq.