CVE-2004-1038

Publication date 1 March 2005

Last updated 24 July 2024

Ubuntu priority

High

Why this priority?

A design error in the IEEE1394 specification allows attackers with physical access to a device to read and write to sensitive memory using a modified FireWire/IEEE 1394 client, thus bypassing intended restrictions that would normally require greater degrees of physical access to exploit. NOTE: this was reported in 2008 to affect Windows Vista, but some Linux-based operating systems have protection mechanisms against this attack.

Read the notes from the security team

Status

Package Ubuntu Release Status
linux-source-2.6.15 9.10 karmic Not in release
9.04 jaunty Not in release
8.10 intrepid Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper Ignored
linux 9.10 karmic Ignored
9.04 jaunty Ignored
8.10 intrepid Ignored
8.04 LTS hardy Ignored
6.06 LTS dapper Not in release

Notes

kees

This is a physical design issue with Firewire. It can be mitigated via setting "options ohci1394 phys_dma=0" in a /etc/modprobe.d/ file, though this will greatly reduce the speed of your Firewire.