CVE-2008-4609
15Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 32%
exploitation probability
32%top 2% of all CVEs
observed exploitation
nono source reports it
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
Affected products
n/a · n/aReferences
http://blog.robertlee.name/2008/10/conjecture-speculation.htmlhttp://insecure.org/stf/tcp-dos-attack-explained.htmlhttp://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.htmlhttp://marc.info/?l=bugtraq&m=125856010926699&w=2https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borkedhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6340https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.htmlhttp://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtmlhttp://www.cisco.com/en/US/products/products_security_response09186a0080a15120.htmlhttp://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdfhttp://www.mandriva.com/security/advisories?name=MDVSA-2013:150