CVE-2008-4609

HIGH 7.1CVE-2008-4609 · Published 20/10/2008 · updated 16/06/2026

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.

References

blog.robertlee.name/2008/10/conjecture-speculation.html · Broken Link
insecure.org/stf/tcp-dos-attack-explained.html · Broken Link
lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html · Broken Link
marc.info · Third Party Advisory
searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked · Broken Link
cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml · Broken Link
cisco.com/en/US/products/products_security_response09186a0080a15120.html · Broken Link
cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf · Broken Link
mandriva.com/security/advisories · Broken Link
oracle.com/technetwork/topics/security/cpujul2012-392727.html · Third Party Advisory
outpost24.com/news/news-2008-10-02.html · Broken Link
us-cert.gov/cas/techalerts/TA09-251A.html · Third Party Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048 · Patch
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6340 · Broken Link
cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html · Broken Link

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free