#VU100003 Security features in Linux kernel - CVE-2002-0060

Vulnerability identifier: #VU100003

Vulnerability risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2002-0060

CWE-ID: CWE-254

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

IRC connection tracking helper module in the netfilter subsystem for Linux 2.4.18-pre9 and earlier does not properly set the mask for conntrack expectations for incoming DCC connections, which could allow remote attackers to bypass intended firewall restrictions.

Mitigation
Install update from vendor's repository.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:041
https://marc.info/?l=bugtraq&m=101483396412051&w=2
https://marc.info/?l=vuln-dev&m=101486352429653&w=2
https://www.kb.cert.org/vuls/id/230307
https://www.netfilter.org/security/2002-02-25-irc-dcc-mask.html
https://www.redhat.com/support/errata/RHSA-2002-028.html
https://www.securityfocus.com/bid/4188
https://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0203-027
https://exchange.xforce.ibmcloud.com/vulnerabilities/8302

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.