PT-2014-7856 · Openbsd+2 · Openbsd+2

Kenji Rikitake · Publicado 2014-12-12 · Atualizado 2014-12-12 · CVE-2014-7250

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions FreeBSD version 5.4 NetBSD versions possibly 2.0 OpenBSD versions possibly 3.6

Description The issue is related to the TCP stack implementation, specifically the session timer, which can be exploited by remote attackers to cause a denial of service through resource consumption by sending crafted packets.

Recommendations For FreeBSD version 5.4, update the TCP stack implementation to properly handle session timers. For NetBSD versions possibly 2.0, consider disabling the vulnerable TCP stack functionality until a proper fix is available. For OpenBSD versions possibly 3.6, restrict access to the TCP stack to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2014-7250

Produtos afetados

Freebsd

Netbsd

Openbsd

Referências · 5

• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000134 · Aviso do Fabricante
• https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=195243 · Nota
• http://jvn.jp/en/jp/JVN07930208/index.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-7250 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2014-7250 · Aviso do Fabricante