Vulnerability in conntrack - security update
Summary
DSA-3341-1: conntrack - security update. Affects conntrack versions < 1:1.2.1-1+deb7u1. Fixed in 1:1.2.1-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The conntrack package is a kernel module that provides connection tracking capabilities for various network protocols. It is responsible for tracking network connections and their states. This vulnerability affects conntrackd, a daemon that synchronizes connection tracking states between multiple hosts. When certain configurations are in place and the conntrack kernel module is not loaded, conntrackd crashes when handling DCCP, SCTP, or ICMPv6 packets.
Vulnerability Detail
The vulnerability arises from a flaw in conntrackd's handling of DCCP, SCTP, and ICMPv6 packets when the relevant conntrack kernel module is not loaded. This flaw can lead to a crash of the conntrackd daemon. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition on the affected system. The impact of this vulnerability is limited to systems where conntrackd is being used and the conntrack kernel module is not loaded.
How To Fix
Minimum fixed version
1:1.2.1-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade conntrackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the conntrack package is vulnerable to a flaw that can cause the conntrackd daemon to crash when handling certain packets. Upgrading to the fixed versions of the conntrack package is recommended to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for conntrack →
FAQ
Conntrack is a kernel module that provides connection tracking capabilities for various network protocols. It is responsible for tracking network connections and their states.
Conntrackd is a daemon that synchronizes connection tracking states between multiple hosts.
The vulnerability can lead to a crash of the conntrackd daemon, potentially causing a denial-of-service (DoS) condition on the affected system.
The vulnerability affects systems where conntrackd is being used and the conntrack kernel module is not loaded.
To fix this vulnerability, upgrade the conntrack package to the appropriate fixed version for your distribution.
Related vulnerabilities
Recent vulnerabilities recorded for conntrack.
