From: Patrick McHardy <kaber@trash.net>
To: stable@kernel.org
Cc:
-Subject: [NETFILTER]: Fix another crash in ip_nat_pptp
+Subject: [NETFILTER]: Fix another crash in ip_nat_pptp (CVE-2006-0037)
The PPTP NAT helper calculates the offset at which the packet needs
to be mangled as difference between two pointers to the header. With
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
net/ipv4/netfilter/ip_nat_helper_pptp.c | 57 +++++++++++++++-----------------
- 1 files changed, 27 insertions(+), 30 deletions(-)
+ 1 file changed, 27 insertions(+), 30 deletions(-)
-Index: linux-2.6.14.6/net/ipv4/netfilter/ip_nat_helper_pptp.c
-===================================================================
--- linux-2.6.14.6.orig/net/ipv4/netfilter/ip_nat_helper_pptp.c
+++ linux-2.6.14.6/net/ipv4/netfilter/ip_nat_helper_pptp.c
@@ -148,14 +148,14 @@ pptp_outbound_pkt(struct sk_buff **pskb,
From: Patrick McHardy <kaber@trash.net>
To: stable@kernel.org
Cc:
-Subject: [NETFILTER]: Fix crash in ip_nat_pptp
+Subject: [NETFILTER]: Fix crash in ip_nat_pptp (CVE-2006-0036)
When an inbound PPTP_IN_CALL_REQUEST packet is received the
PPTP NAT helper uses a NULL pointer in pointer arithmentic to
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
net/ipv4/netfilter/ip_nat_helper_pptp.c | 2 +-
- 1 files changed, 1 insertion(+), 1 deletion(-)
+ 1 file changed, 1 insertion(+), 1 deletion(-)
-Index: linux-2.6.14.6/net/ipv4/netfilter/ip_nat_helper_pptp.c
-===================================================================
--- linux-2.6.14.6.orig/net/ipv4/netfilter/ip_nat_helper_pptp.c
+++ linux-2.6.14.6/net/ipv4/netfilter/ip_nat_helper_pptp.c
@@ -313,7 +313,7 @@ pptp_inbound_pkt(struct sk_buff **pskb,
From: Patrick McHardy <kaber@trash.net>
To: stable@kernel.org
Cc:
-Subject: [NETFILTER]: Fix another crash in ip_nat_pptp
+Subject: [NETFILTER]: Fix another crash in ip_nat_pptp (CVE-2006-0037)
The PPTP NAT helper calculates the offset at which the packet needs
to be mangled as difference between two pointers to the header. With
From: Patrick McHardy <kaber@trash.net>
To: stable@kernel.org
Cc:
-Subject: [NETFILTER]: Fix crash in ip_nat_pptp
+Subject: [NETFILTER]: Fix crash in ip_nat_pptp (CVE-2006-0036)
When an inbound PPTP_IN_CALL_REQUEST packet is received the
PPTP NAT helper uses a NULL pointer in pointer arithmentic to