{"id":"CVE-2009-0687","aliases":["EUVD-2009-0687","GHSA-r7qv-r86r-qrqf"],"status":"published","title":"The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5,...","description":"The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload.","severity":{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.09523,"percentile":0.95486,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-399"],"published":"2009-08-11T10:00:00Z","modified":"2026-06-16T23:05:33Z","exploits":[{"source":"exploitdb","id":"EDB-8406","title":"OpenBSD 4.5 - IP datagrams Remote Denial of Service","type":"dos","platform":"openbsd","date":"2009-04-13","verified":true,"url":"https://www.exploit-db.com/exploits/8406"},{"source":"exploitdb","id":"EDB-8430","title":"OpenBSD 4.5 - IP datagram Null Pointer Deref Denial of Service","type":"dos","platform":"openbsd","date":"2009-04-14","verified":true,"url":"https://www.exploit-db.com/exploits/8430"},{"source":"exploitdb","id":"EDB-8581","title":"Multiple Vendor - PF Null Pointer Dereference","type":"dos","platform":"bsd","date":"2009-04-30","verified":true,"url":"https://www.exploit-db.com/exploits/8581"}],"products":[{"vendor":"midnightbsd","product":"midnightbsd"},{"vendor":"mirbsd","product":"miros"},{"vendor":"netbsd","product":"netbsd"},{"vendor":"openbsd","product":"openbsd"}],"references":[{"url":"http://www.osvdb.org/53608","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.openbsd.org/errata43.html#013_pf","tags":["vendor-advisory","x_refsource_OPENBSD","x_transferred","Patch","Vendor Advisory"]},{"url":"http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-001.txt.asc","tags":["vendor-advisory","x_refsource_NETBSD","x_transferred","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/8406","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/49837","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.helith.net/txt/multiple_vendor-PF_null_pointer_dereference.txt","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/502634","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/8581","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://www.openbsd.org/errata44.html#013_pf","tags":["vendor-advisory","x_refsource_OPENBSD","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/1015","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Patch","Vendor Advisory"]},{"url":"ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/013_pf.patch","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.openbsd.org/errata45.html#002_pf","tags":["vendor-advisory","x_refsource_OPENBSD","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0687"},{"url":"https://github.com/advisories/GHSA-r7qv-r86r-qrqf"}],"sources":{"cve":[{"id":"CVE-2009-0687","description":"The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload.","status":"published","published":"2009-08-11T10:00:00Z","modified":"2024-08-07T04:40:05.296Z","updated_at":"2026-11-02T14:33:25.896677Z"}],"euvd":[{"id":"EUVD-2009-0687","description":"The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload.","status":"published","published":"2009-08-11T10:00:00Z","modified":"2024-08-07T04:40:05Z","updated_at":"2026-11-03T01:39:24.749817Z"}],"ghsa":[{"id":"GHSA-r7qv-r86r-qrqf","title":"The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5,...","description":"The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload.","status":"published","published":"2022-05-03T03:20:23Z","modified":"2023-02-01T05:01:25Z","updated_at":"2026-11-02T14:49:43.293288Z"}],"nvd":[{"id":"CVE-2009-0687","description":"The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload.","status":"published","published":"2009-08-11T10:30:00.217Z","modified":"2026-06-16T23:05:33.99Z","cvss":[{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:01:36.200173Z"}]}}