CVE-2008-4609

Severity: high (CVSS 7.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 32.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-10-20 · updated 2026-06-16
Weakness: CWE-16

Description

The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.

Affected products

Bsd: 4.1, 4.2, 4.3, 4.4
Bsdi Bsd Os: 1.1, 2.0, 2.0.1, 2.1, 3.0, 3.1 (+5)
Cisco Catalyst Blade Switch 3020 Firmware: before 12.2\(50\) — fixed in 12.2\(50\)
Cisco Catalyst Blade Switch 3120 Firmware: before 12.2\(50\) — fixed in 12.2\(50\)
Cisco Catalyst Blade Switch 3120X Firmware: before 12.2\(50\) — fixed in 12.2\(50\)
Cisco IOS: 4.1, 4.1.1, 4.1.2, 8.2, 8.3, 9.0 (+1451)
Dragonflybsd: 1.0, 1.1, 1.2, 1.10.1
FreeBSD: 0.4_1, 1.0, 1.1, 1.1.5, 1.1.5.1, 1.2 (+62)
Linux kernel: 1.2.0, 1.3.0, 2.0, 2.0.1, 2.0.2, 2.0.3 (+416)
Microsoft Windows 2000: all versions
Microsoft Windows Server 2003: all versions
Microsoft Windows Server 2008: all versions
Microsoft Windows Vista: all versions
Microsoft Windows XP Service Pack 3: all versions
Midnightbsd: all versions
Netbsd: 1.0, 1.1, 1.2, 1.2.1, 1.3, 1.3.1 (+26)
OpenBSD: 2.0, 2.1, 2.2, 2.3, 2.4, 2.5 (+18)
Oracle Corporation Solaris Operating System: 8, 9, 10
Trustedbsd: all versions

How to fix

Upgrade to a fixed version: Cisco Catalyst Blade Switch 3020 Firmware 12.2\(50\); Cisco Catalyst Blade Switch 3120 Firmware 12.2\(50\); Cisco Catalyst Blade Switch 3120X Firmware 12.2\(50\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2008-4609 or the next vulnerability affects your stack