Details of VAR-200912-0195

ID

VAR-200912-0195

CVE

CVE-2009-4293

TITLE

SEIL/X Series and SEIL/B1 denial of service vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2009-000070

DESCRIPTION

Internet Initiative Japan SEIL/X1, SEIL/X2, and SEIL/B1 firmware 2.30 through 2.51, when NAT is enabled, allows remote attackers to cause a denial of service (system restart) via crafted GRE packets. SEIL/X Series and SEIL/B1 contain a denial of service (DoS) vulnerability. SEIL/X Series and SEIL/B1 are routers. Successfully exploiting these issues allows remote attackers to execute arbitrary code with administrative privileges or crash the affected device, denying service to legitimate users. The following devices are affected: SEIL/X1 2.40 to 2.51 SEIL/X2 2.40 to 2.51 SEIL/B1 2.40 to 2.51. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: SEIL Routers Denial of Service and Buffer Overflow Vulnerabilities SECUNIA ADVISORY ID: SA37154 VERIFY ADVISORY: http://secunia.com/advisories/37154/ DESCRIPTION: Some vulnerabilities have been reported in the SEIL/X1, X2, and B1 routers, which can be exploited by malicious people to cause a DoS (Denial of Service) and compromise a vulnerable system. 1) An error exists when processing of certain GRE packets. Note: Successful exploitation requires that the NAT functionality is enabled. 2) A buffer overflow error exists within the URL filtering functionality. This can be exploited to cause a buffer overflow and potentially execute arbitrary code by tricking a user into visiting a specially crafted website. Vulnerability #1 is reported in SEIL/X1, X2, and B1 version 2.30 to 2.51 and vulnerability #2 is reported in SEIL/X1, X2, and B1 version 2.40 to 2.51. SOLUTION: Update to version 2.52. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: 1) http://jvn.jp/jp/JVN13011682/index.html http://www.seil.jp/seilseries/security/2009/a00674.php 2) http://jvn.jp/jp/JVN06362164/index.html http://www.seil.jp/seilseries/security/2009/a00669.php ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2009-4293 // JVNDB: JVNDB-2009-000070 // BID: 36896 // VULHUB: VHN-41739 // PACKETSTORM: 82299

AFFECTED PRODUCTS

vendor:	iij	model:	seil\/b1	scope:	eq	version:	2.40	Trust: 1.6
vendor:	iij	model:	seil\/b1	scope:	eq	version:	2.42	Trust: 1.6
vendor:	iij	model:	seil\/x1	scope:	eq	version:	2.51	Trust: 1.6
vendor:	iij	model:	seil\/x1	scope:	eq	version:	2.30	Trust: 1.6
vendor:	iij	model:	seil\/x1	scope:	eq	version:	2.50	Trust: 1.6
vendor:	iij	model:	seil\/x1	scope:	eq	version:	2.42	Trust: 1.6
vendor:	iij	model:	seil\/b1	scope:	eq	version:	2.41	Trust: 1.6
vendor:	iij	model:	seil\/x1	scope:	eq	version:	2.40	Trust: 1.6
vendor:	iij	model:	seil\/x1	scope:	eq	version:	2.41	Trust: 1.6
vendor:	iij	model:	seil\/b1	scope:	eq	version:	2.30	Trust: 1.6
vendor:	iij	model:	seil\/x2	scope:	eq	version:	2.50	Trust: 1.0
vendor:	iij	model:	seil\/x2	scope:	eq	version:	*	Trust: 1.0
vendor:	iij	model:	seil\/b1	scope:	eq	version:	*	Trust: 1.0
vendor:	iij	model:	seil\/b1	scope:	eq	version:	2.51	Trust: 1.0
vendor:	iij	model:	seil\/x2	scope:	eq	version:	2.30	Trust: 1.0
vendor:	iij	model:	seil\/x2	scope:	eq	version:	2.42	Trust: 1.0
vendor:	iij	model:	seil\/x1	scope:	eq	version:	*	Trust: 1.0
vendor:	iij	model:	seil\/b1	scope:	eq	version:	2.50	Trust: 1.0
vendor:	iij	model:	seil\/x2	scope:	eq	version:	2.40	Trust: 1.0
vendor:	iij	model:	seil\/x2	scope:	eq	version:	2.41	Trust: 1.0
vendor:	iij	model:	seil\/x2	scope:	eq	version:	2.51	Trust: 1.0
vendor:	internet initiative	model:	seil/b1	scope:	eq	version:	firmware 2.30 to 2.51	Trust: 0.8
vendor:	internet initiative	model:	seil/x1	scope:	eq	version:	firmware 2.30 to 2.51	Trust: 0.8
vendor:	internet initiative	model:	seil/x2	scope:	eq	version:	firmware 2.30 to 2.51	Trust: 0.8
vendor:	seil	model:	seil/x2	scope:	eq	version:	2.51	Trust: 0.3
vendor:	seil	model:	seil/x2	scope:	eq	version:	2.50	Trust: 0.3
vendor:	seil	model:	seil/x2	scope:	eq	version:	2.49	Trust: 0.3
vendor:	seil	model:	seil/x2	scope:	eq	version:	2.48	Trust: 0.3
vendor:	seil	model:	seil/x2	scope:	eq	version:	2.47	Trust: 0.3
vendor:	seil	model:	seil/x2	scope:	eq	version:	2.46	Trust: 0.3
vendor:	seil	model:	seil/x2	scope:	eq	version:	2.45	Trust: 0.3
vendor:	seil	model:	seil/x2	scope:	eq	version:	2.44	Trust: 0.3
vendor:	seil	model:	seil/x2	scope:	eq	version:	2.43	Trust: 0.3
vendor:	seil	model:	seil/x2	scope:	eq	version:	2.42	Trust: 0.3
vendor:	seil	model:	seil/x2	scope:	eq	version:	2.41	Trust: 0.3
vendor:	seil	model:	seil/x2	scope:	eq	version:	2.40	Trust: 0.3
vendor:	seil	model:	seil/x1	scope:	eq	version:	2.51	Trust: 0.3
vendor:	seil	model:	seil/x1	scope:	eq	version:	2.50	Trust: 0.3
vendor:	seil	model:	seil/x1	scope:	eq	version:	2.49	Trust: 0.3
vendor:	seil	model:	seil/x1	scope:	eq	version:	2.48	Trust: 0.3
vendor:	seil	model:	seil/x1	scope:	eq	version:	2.47	Trust: 0.3
vendor:	seil	model:	seil/x1	scope:	eq	version:	2.46	Trust: 0.3
vendor:	seil	model:	seil/x1	scope:	eq	version:	2.45	Trust: 0.3
vendor:	seil	model:	seil/x1	scope:	eq	version:	2.44	Trust: 0.3
vendor:	seil	model:	seil/x1	scope:	eq	version:	2.43	Trust: 0.3
vendor:	seil	model:	seil/x1	scope:	eq	version:	2.42	Trust: 0.3
vendor:	seil	model:	seil/x1	scope:	eq	version:	2.41	Trust: 0.3
vendor:	seil	model:	seil/x1	scope:	eq	version:	2.40	Trust: 0.3
vendor:	seil	model:	seil/b1	scope:	eq	version:	2.51	Trust: 0.3
vendor:	seil	model:	seil/b1	scope:	eq	version:	2.50	Trust: 0.3
vendor:	seil	model:	seil/b1	scope:	eq	version:	2.48	Trust: 0.3
vendor:	seil	model:	seil/x2	scope:	ne	version:	2.52	Trust: 0.3
vendor:	seil	model:	seil/x1	scope:	ne	version:	2.52	Trust: 0.3
vendor:	seil	model:	seil/b1	scope:	ne	version:	2.52	Trust: 0.3

sources: BID: 36896 // JVNDB: JVNDB-2009-000070 // CNNVD: CNNVD-200912-157 // NVD: CVE-2009-4293

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2009-4293
value:	HIGH
Trust: 1.0
IPA:	JVNDB-2009-000070
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200912-157
value:	HIGH
Trust: 0.6
VULHUB:	VHN-41739
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2009-4293
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
IPA:	JVNDB-2009-000070
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
VULHUB:	VHN-41739
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-41739 // JVNDB: JVNDB-2009-000070 // CNNVD: CNNVD-200912-157 // NVD: CVE-2009-4293

PROBLEMTYPE DATA

problemtype:	CWE-16	Trust: 1.1
problemtype:	CWE-20	Trust: 0.8

sources: VULHUB: VHN-41739 // JVNDB: JVNDB-2009-000070 // NVD: CVE-2009-4293

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200912-157

TYPE

configuration error

Trust: 0.6

sources: CNNVD: CNNVD-200912-157

CONFIGURATIONS

sources: JVNDB: JVNDB-2009-000070

PATCH

title:

a00674.php

url:

http://www.seil.jp/seilseries/security/2009/a00674.php

Trust: 0.8

sources: JVNDB: JVNDB-2009-000070

EXTERNAL IDS

db:	JVN	id:	JVN13011682	Trust: 2.9
db:	NVD	id:	CVE-2009-4293	Trust: 2.8
db:	SECUNIA	id:	37154	Trust: 2.7
db:	OSVDB	id:	59361	Trust: 2.5
db:	VUPEN	id:	ADV-2009-3111	Trust: 2.5
db:	JVNDB	id:	JVNDB-2009-000070	Trust: 2.5
db:	XF	id:	54050	Trust: 1.4
db:	CNNVD	id:	CNNVD-200912-157	Trust: 0.7
db:	JVN	id:	JVN#13011682	Trust: 0.6
db:	JVN	id:	JVN06362164	Trust: 0.4
db:	BID	id:	36896	Trust: 0.3
db:	VULHUB	id:	VHN-41739	Trust: 0.1
db:	PACKETSTORM	id:	82299	Trust: 0.1

sources: VULHUB: VHN-41739 // BID: 36896 // JVNDB: JVNDB-2009-000070 // PACKETSTORM: 82299 // CNNVD: CNNVD-200912-157 // NVD: CVE-2009-4293

REFERENCES

url:	http://jvn.jp/en/jp/jvn13011682/index.html	Trust: 2.8
url:	http://osvdb.org/59361	Trust: 2.5
url:	http://secunia.com/advisories/37154	Trust: 2.5
url:	http://www.vupen.com/english/advisories/2009/3111	Trust: 2.5
url:	http://www.seil.jp/seilseries/security/2009/a00674.php	Trust: 2.1
url:	http://jvndb.jvn.jp/en/contents/2009/jvndb-2009-000070.html	Trust: 1.7
url:	http://xforce.iss.net/xforce/xfdb/54050	Trust: 1.4
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/54050	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4293	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4293	Trust: 0.8
url:	http://www.seil.jp/seilseries/security/2009/a00669.php	Trust: 0.4
url:	http://jvn.jp/en/jp/jvn06362164/index.html	Trust: 0.3
url:	http://www.seil.jp/	Trust: 0.3
url:	http://jvn.jp/jp/jvn13011682/index.html	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://jvn.jp/jp/jvn06362164/index.html	Trust: 0.1
url:	http://secunia.com/advisories/business_solutions/	Trust: 0.1
url:	http://secunia.com/advisories/37154/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1

sources: VULHUB: VHN-41739 // BID: 36896 // JVNDB: JVNDB-2009-000070 // PACKETSTORM: 82299 // CNNVD: CNNVD-200912-157 // NVD: CVE-2009-4293

CREDITS

JPCERT/CC

Trust: 0.3

sources: BID: 36896

SOURCES

db:	VULHUB	id:	VHN-41739
db:	BID	id:	36896
db:	JVNDB	id:	JVNDB-2009-000070
db:	PACKETSTORM	id:	82299
db:	CNNVD	id:	CNNVD-200912-157
db:	NVD	id:	CVE-2009-4293

LAST UPDATE DATE

2025-04-10T23:05:00.224000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-41739	date:	2017-08-17T00:00:00
db:	BID	id:	36896	date:	2010-08-11T11:34:00
db:	JVNDB	id:	JVNDB-2009-000070	date:	2009-11-02T00:00:00
db:	CNNVD	id:	CNNVD-200912-157	date:	2009-12-11T00:00:00
db:	NVD	id:	CVE-2009-4293	date:	2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-41739	date:	2009-12-10T00:00:00
db:	BID	id:	36896	date:	2009-11-02T00:00:00
db:	JVNDB	id:	JVNDB-2009-000070	date:	2009-11-02T00:00:00
db:	PACKETSTORM	id:	82299	date:	2009-10-28T10:48:16
db:	CNNVD	id:	CNNVD-200912-157	date:	2009-12-10T00:00:00
db:	NVD	id:	CVE-2009-4293	date:	2009-12-10T23:30:00.420