CVE-2008-4609
No CVSS score yet. EPSS 32% chance of exploitation in the next 30 days.
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
- EPSS
- 32% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWE
- CWE-16
- Published
- Modified
- Record from
- the NVD, synced
Affected
- bsd:bsd
- bsdi:bsd_os
- cisco:catalyst_blade_switch_3020_firmware
- cisco:catalyst_blade_switch_3120_firmware
- cisco:catalyst_blade_switch_3120x_firmware
- cisco:ios
- dragonflybsd:dragonflybsd
- freebsd:freebsd
- linux:linux_kernel
- microsoft:windows_2000
- microsoft:windows_server_2003
- microsoft:windows_server_2008
- microsoft:windows_vista
- microsoft:windows_xp
- midnightbsd:midnightbsd
- netbsd:netbsd
- openbsd:openbsd
- oracle:solaris
- trustedbsd:trustedbsd
References
- http://blog.robertlee.name/2008/10/conjecture-speculation.html
- http://insecure.org/stf/tcp-dos-attack-explained.html
- http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html
- http://marc.info/?l=bugtraq&m=125856010926699&w=2
- http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked