CVE-2008-0177

The ipcomp6_input function in sys/netinet6/ipcomp_input.c in the KAME project before 20071201 does not properly check the return value of the m_pulldown function, which allows remote attackers to cause a denial of service (system crash) via an IPv6 packet with an IPComp header.

• http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet6/ipcomp_input.c?f=u&only_with_tag=netbsd-3-1Vendor Advisory
• http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html
• http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
• http://secunia.com/advisories/28788Patch, Vendor Advisory
• http://secunia.com/advisories/28816Vendor Advisory
• http://secunia.com/advisories/28979
• http://secunia.com/advisories/29130
• http://secunia.com/advisories/30430
• http://secunia.com/advisories/31074
• http://security.freebsd.org/advisories/FreeBSD-SA-08:04.ipsec.asc
• http://securitytracker.com/id?1019314
• http://www.kame.net/dev/cvsweb2.cgi/kame/kame/sys/netinet6/ipcomp_input.c.diff?r1=1.36%3Br2=1.37
• http://www.kb.cert.org/vuls/id/110947US Government Resource
• http://www.securityfocus.com/bid/27642Patch
• http://www.us-cert.gov/cas/techalerts/TA08-150A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/0441
• http://www.vupen.com/english/advisories/2008/0688
• http://www.vupen.com/english/advisories/2008/1697
• http://www.vupen.com/english/advisories/2008/2094/references
• https://www.exploit-db.com/exploits/5191
• http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netinet6/ipcomp_input.c?f=u&only_with_tag=netbsd-3-1Vendor Advisory
• http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html
• http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
• http://secunia.com/advisories/28788Patch, Vendor Advisory
• http://secunia.com/advisories/28816Vendor Advisory
• http://secunia.com/advisories/28979
• http://secunia.com/advisories/29130
• http://secunia.com/advisories/30430
• http://secunia.com/advisories/31074
• http://security.freebsd.org/advisories/FreeBSD-SA-08:04.ipsec.asc
• http://securitytracker.com/id?1019314
• http://www.kame.net/dev/cvsweb2.cgi/kame/kame/sys/netinet6/ipcomp_input.c.diff?r1=1.36%3Br2=1.37
• http://www.kb.cert.org/vuls/id/110947US Government Resource
• http://www.securityfocus.com/bid/27642Patch
• http://www.us-cert.gov/cas/techalerts/TA08-150A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/0441
• http://www.vupen.com/english/advisories/2008/0688
• http://www.vupen.com/english/advisories/2008/1697
• http://www.vupen.com/english/advisories/2008/2094/references
• https://www.exploit-db.com/exploits/5191

Published

Feb 7, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-0171regex/v4/perl_matcher_non_recursive.hpp in the Boost regex l…
• CVE-2008-0172The get_repeat_type function in basic_regex_creator.hpp in t…
• CVE-2008-0173SQL injection vulnerability in Gforge 4.6.99 and earlier all…
• CVE-2008-0174GE Fanuc Proficy Real-Time Information Portal 2.6 and earlie…9.8
• CVE-2008-0175Unrestricted file upload vulnerability in GE Fanuc Proficy R…
• CVE-2008-0176Heap-based buffer overflow in w32rtr.exe in GE Fanuc CIMPLIC…
• CVE-2008-0178Cross-site scripting (XSS) vulnerability in the Enterprise A…
• CVE-2008-0179Cross-site scripting (XSS) vulnerability in service/impl/Use…
• CVE-2008-0180Cross-site scripting (XSS) vulnerability in themes/_unstyled…
• CVE-2008-0181Cross-site scripting (XSS) vulnerability in the Admin portle…
• CVE-2008-0182Cross-site request forgery (CSRF) vulnerability in the Admin…
• CVE-2008-0184Absolute path traversal vulnerability in index.php in Sys-Ho…