PT-2003-2175 · Freebsd · Freebsd

Published 2003-12-31 · Updated 2017-07-11 · CVE-2003-1230

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 4.5 through 5.0-RELEASE-p3

Description The issue concerns the implementation of SYN cookies in FreeBSD, which uses 32-bit internal keys for generating syncookies. This makes it easier for remote attackers to conduct brute force ISN guessing attacks, allowing them to spoof legitimate traffic.

Recommendations For versions 4.5 through 5.0-RELEASE-p3, consider upgrading to a version that implements more secure syncookie generation to prevent brute force ISN guessing attacks.

Fix

Related Identifiers

CVE-2003-1230

Affected Products

Freebsd

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2003-1230 · Security Note
• http://secunia.com/advisories/8142 · Vendor Advisory
• http://securityfocus.com/advisories/5013 · Vendor Advisory
• http://securityfocus.com/bid/6920 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11397 · Note
• http://osvdb.org/19785 · Note