CVE-2006-3121 The peel_netstring function in cl_netstring.c in the heartbeat subsystem in High-Availability Linux before 1.2.5, and 2.0 before 2.0.7, allows remote attackers to cause a denial of service (crash) via...
MediumCVSS 5.0
EPSS 13.6%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The peel_netstring function in cl_netstring.c in the heartbeat subsystem in High-Availability Linux before 1.2.5, and 2.0 before 2.0.7, allows remote attackers to cause a denial of service (crash) via the length parameter in a heartbeat message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| high availability linux project heartbeat | = 1.2.3 | No fix listed |
| high availability linux project heartbeat | = 1.2.4 | No fix listed |
| high availability linux project heartbeat | = 2.0.1 | No fix listed |
| high availability linux project heartbeat | = 2.0.2 | No fix listed |
| high availability linux project heartbeat | = 2.0.3 | No fix listed |
| high availability linux project heartbeat | = 2.0.4 | No fix listed |
| high availability linux project heartbeat | = 2.0.5 | No fix listed |
| high availability linux project heartbeat | = 2.0.6 | No fix listed |
| debian/heartbeat(Debian:12) | < 1.2.4-14 | 1.2.4-14 |
| debian/heartbeat(Debian:13) | < 1.2.4-14 | 1.2.4-14 |
| debian/heartbeat(Debian:14) | < 1.2.4-14 | 1.2.4-14 |
References
- Debian Security Tracker CVE-2006-3121 vendor-advisory
- 21505 third-party-advisory vendor-advisory
- 21511 third-party-advisory vendor-advisory
- 21518 third-party-advisory vendor-advisory
- 21521 third-party-advisory vendor-advisory
- 21629 third-party-advisory vendor-advisory
- GLSA-200608-23 vendor-advisory
- DSA-1151 patch vendor-advisory
- www.linux-ha.org patch
- www.linux-ha.org
- MDKSA-2006:142 vendor-advisory
- 19516 patch vdb-entry
- USN-335-1 vendor-advisory
- ADV-2006-3288 vdb-entry vendor-advisory
- heartbeat-packet-dos(28396) vdb-entry