CVE-2006-3920

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-07-28 · updated 2026-06-16

Description

The TCP implementation in Sun Solaris 8, 9, and 10 before 20060726 allows remote attackers to cause a denial of service (resource exhaustion) via a TCP packet with an incorrect sequence number, which triggers an ACK storm.

Affected products

Sun Solaris: 9.0, 10.0
Sunos: 5.8

References

http://secunia.com/advisories/21226
http://secunia.com/advisories/22425
http://securitytracker.com/id?1016589
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102206-1
http://support.avaya.com/elmodocs2/security/ASA-2006-204.htm
http://www.vupen.com/english/advisories/2006/2997
https://exchange.xforce.ibmcloud.com/vulnerabilities/28048
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1374
http://secunia.com/advisories/21226
http://secunia.com/advisories/22425
http://securitytracker.com/id?1016589
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102206-1

Get alerted when CVE-2006-3920 or the next vulnerability affects your stack