vulnwire
5.0med

CVE-2003-00013 exploits

Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain in…

Published 23 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
72.5%
percentile 99%
Public exploits
3
Exploit-DB

Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak.

Exploit prediction (EPSS)

72.51% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

  • EDB-3555 Ethernet Device Drivers Frame Padding - 'Etherleak' Infomation Leakage · remote · 2007-03-23
  • EDB-26076 Cisco ASA < 8.4.4.6 < 8.2.5.32 - Ethernet Information Leak · dos · 2013-06-10
  • EDB-22131 Linux Kernel 2.0.x/2.2.x/2.4.x (FreeBSD 4.x) - Network Device Driver Frame Padding Information Disclosure · remote · 2007-03-23

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Technology feeds
Linux kernel (RSS, critical only)

References

  • securityfocus.com /archive/1/307564/30/26270/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securitytracker.com /id/1031583 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • osvdb.org /9962 · vdb-entry, x_refsource_OSVDB, x_transferred
  • redhat.com /support/errata/RHSA-2003-088.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • oracle.com /technetwork/topics/security/cpujan2015-1972971.html · x_refsource_CONFIRM, x_transferred
  • marc.info /?l=bugtraq&m=104222046632243&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • kb.cert.org /vuls/id/412115 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • securityfocus.com /archive/1/305335/30/26420/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2665 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • archives.neohapsis.com /archives/vulnwatch/2003-q1/0016.html · mailing-list, x_refsource_VULNWATCH, x_transferred
  • redhat.com /support/errata/RHSA-2003-025.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • secunia.com /advisories/7996 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • atstake.com /research/advisories/2003/a010603-1.txt · vendor-advisory, x_refsource_ATSTAKE, x_transferred
  • securitytracker.com /id/1040185 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • atstake.com /research/advisories/2003/atstake_etherleak_report.pdf · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.