PT-2014-4190 · Freebsd · Freebsd

Published 2014-04-16 · Updated 2019-03-18 · CVE-2014-1453

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.3 through 10.0

Description The issue concerns the NFS server in FreeBSD, where it fails to acquire locks in the proper order when converting a directory file handle to a vnode. This allows remote authenticated users to cause a denial of service, specifically a deadlock, through certain vectors involving a thread that uses the correct locking order.

Recommendations For versions 8.3 through 10.0, consider applying a patch or fix that corrects the locking order issue in the NFS server to prevent deadlocks.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2014-1453

DSA-2952-1

Affected Products

Freebsd

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2014-1453 · Security Note
• http://freebsd.org/security/advisories/FreeBSD-SA-14:05.nfsserver.asc · Vendor Advisory
• http://debian.org/security/2014/dsa-2952 · Vendor Advisory
• http://secunia.com/advisories/57760 · Vendor Advisory
• http://securitytracker.com/id/1030041 · Note
• http://secunia.com/advisories/59034 · Note
• http://securityfocus.com/bid/66726 · Note