HOMEVULNERABILITIESCVE-2008-4609
HIGH

CVE-2008-4609

CWE-16Published: October 20, 2008· Updated: Jun 16, 2026

7.1
CVSS v3.1

Official Description

The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.

NVD Source

Technical Analysis

CVE-2008-4609 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityM
Privileges Req.
User Interaction
Scope
Impact
ConfidentialityNone
IntegrityNone
AvailabilityC
AV:N/AC:M/Au:N/C:N/I:N/A:C

Affected Vendors & Products

bsd1 product(s)
bsd
bsdi1 product(s)
bsd os
Cisco7 product(s)
ioscatalyst blade switch 3020 firmwarecatalyst blade switch 3020catalyst blade switch 3120 firmwarecatalyst blade switch 3120catalyst blade switch 3120x firmwarecatalyst blade switch 3120x
dragonflybsd1 product(s)
dragonflybsd
freebsd1 product(s)
freebsd
Linux1 product(s)
linux kernel
Microsoft5 product(s)
windows 2000windows server 2003windows server 2008windows vistawindows xp
midnightbsd1 product(s)
midnightbsd
netbsd1 product(s)
netbsd
openbsd1 product(s)
openbsd
Oracle1 product(s)
solaris
trustedbsd1 product(s)
trustedbsd
Source: NVD CPE · 2038 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048
PATCHhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048
ADVISORYhttp://marc.info/?l=bugtraq&m=125856010926699&w=2
ADVISORYhttp://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
ADVISORYhttp://www.us-cert.gov/cas/techalerts/TA09-251A.html
ADVISORYhttp://marc.info/?l=bugtraq&m=125856010926699&w=2
ADVISORYhttp://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
ADVISORYhttp://www.us-cert.gov/cas/techalerts/TA09-251A.html

All References (30)

→
http://blog.robertlee.name/2008/10/conjecture-speculation.htmlBroken Link
→
http://insecure.org/stf/tcp-dos-attack-explained.htmlBroken Link
→
http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.htmlBroken Link
→
http://marc.info/?l=bugtraq&m=125856010926699&w=2Third Party Advisory
→
http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borkedBroken Link
→
http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtmlBroken Link
→
http://www.cisco.com/en/US/products/products_security_response09186a0080a15120.htmlBroken Link
→
http://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdfBroken Link
→
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150Broken Link
→
http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.htmlThird Party Advisory
→
http://www.outpost24.com/news/news-2008-10-02.htmlBroken Link
→
http://www.us-cert.gov/cas/techalerts/TA09-251A.htmlThird Party Advisory · US Government Resource
→
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048Patch · Third Party Advisory
→
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6340Broken Link
→
https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.htmlBroken Link

Quick Facts

CVE IDCVE-2008-4609
CVSS Score7.1 / 10
SeverityHIGH
WeaknessCWE-16
CISA KEVNo
Affected12 vendor(s)
PublishedOct 20, 2008

Related CVEs (CWE-16)

CVE-2007-5419
10.0
CVE-2005-4837
10.0
CVE-2003-1422
10.0
CVE-2009-2357
10.0
CVE-2008-6820
10.0
CVE-2009-0621
10.0

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2008-4609 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2008-4609·NVD