-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Reference: CERT-EU Security Advisory 2011-0019

Linux Kernel CVE-2011-3593 VLAN Packets Handling Remote Denial of Service [1]

Version history:
23.11.2011 Initial publication

Summary
=======
The Linux kernel  is prone to a remote denial-of-service vulnerability. Specifically, this issue occurs when using certain network drivers for handling VLAN 0 frames with the priority tag set.

Attackers can remotely exploit this issue by sending specially crafted packets to the affected computer.

An attacker can exploit this issue to cause the kernel to crash, denying service to legitimate users.

CVE-2011-3593 (Candidate)

Severity Level[2]: CVSS2 Base 6.1
 
Remote              Yes
Local               No
Credibility         Vendor Confirmed
Ease                Exploit Available
Authentication      Not Required

Potential impact
================

Attackers can exploit this issue to cause the kernel to crash, denying service to legitimate users.

1. An attacker locates a vulnerable computer and gains local area network access.

2. The attacker constructs malicious packets designed to trigger this issue.

3. The attacker sends the packets to the affected computer.

4. When the packets are being processed, the kernel will crash, denying service to legitimate users.

Vulnerable Systems
==================
Among others:

Linux kernel  2.6.11.x - 2.6.39.x

What can you do?
================

Solutions:

Fixes are available.

Work-arounds:


Block external access at the network boundary, unless external parties require service.

Filter access to the affected computer at the network boundary if global access isn't needed. Restricting access to only trusted computers and networks might greatly reduce the likelihood of a successful exploit.

Deploy network intrusion detection systems to monitor network traffic for malicious activity.  Deploy NIDS to monitor network traffic for signs of anomalous or suspicious activity. This may indicate exploit attempts or activity that results from successful exploits.


What to tell your users?
========================
Normal security best practices apply. Especially, inform your Web users to be cautious about following links to sites that are provided by unfamiliar or suspicious sources.  Users are to be aware not to click on the link in suspicious emails; to immediately forward the suspicious email to the respective IT security officer / contact in your institution.

More information
================
[1] http://www.kernel.org/

[2] CVSS details:
CVSS Version 2 Scores
CVSS2 Base          6.1
CVSS2 Temporal      5
CVSS2 Base Vector   AV:A/AC:L/Au:N/C:N/I:N/A:C
CVSS2 Temporal VectorE:F/RL:OF/RC:C

More information about CVSS is available at: http://www.first.org/cvss/cvss-guide.html

Best regards,

CERT-EU Pre-configuration Team (http://cert.europa.eu)
Phone: +32.2.2990005 / e-mail: cert-eu@ec.europa.eu
PGP KeyID 0x46AC4383
FP: 9011 6BE9 D642 DD93 8348 DAFA 27A4 06CA 46AC 4383
-----BEGIN PGP SIGNATURE-----
Version: BCPG v1.39

iQJXBAEBAgBBBQJOzNoyOhxDRVJUIGZvciB0aGUgRXVyb3BlYW4gSW5zdGl0dXRp
b25zIDxjZXJ0LWV1QGVjLmV1cm9wYS5ldT4ACgkQJ6QGykasQ4NWBQ/9HDcjv3nR
/4q+px5REY7XUnkfS7izpBXAj4/3wp4jKCuAeb5u8FwqKdKZr9jtzcqCg/TeLOIN
LJnd23IjVVIwnSAptuPikq7XsMtrji4OhQZ9PNbD7nUdvFibUs8RVrae5m2opYev
utqNJBi2t41SACmHRGX46Me4Exn716MDFO3lKUHwRvsG24ov20Uds++FUgzu/Ey1
LnmSZE0ODZlZW9SkalOyhwey4s7sU6ZvMjtOzfgCTDIPfHi8oO+pkUwW352YUlyz
OTuVE32iUs3wfwXX4SQDec68ash3vBsB0ziRFBm05naTB2XLaJK01fQVFQF0dZZD
iZHJHf1l331VxCyfr6ls0DDvEfeamyJir8hr+W1Ol8S9HVfsiHzyEkJlv8ay7sXi
6flTItFRLZarmDyDwvAUm0MPmqm8bnO8UC9ExIWKW1lBFHluQLnckUSqplcBFQZY
tUKjKeHQpkcz16afJGFIq4sgs+q+erWie4O5eQCkYQKaDfF/0H3mO0XgoqmU1YfQ
TTzXh4xjdgzCkls23ZlIXiOvolxj7dWUTTmPWUOrnnBADt2Wm4KWujSjlCpIsJR5
rPE53uKJZfvPsx7Kuc0FRlmFR/nsSlbVaIKtAT8z0vCSy1uHprsfSMJABynu72gW
6JJPIvxBuQNqRwzOIKCVaXS6kGErK2UNPB8=
=jI5y
-----END PGP SIGNATURE-----