PT-2014-7856 · Openbsd+2 · Openbsd+2

Kenji Rikitake · Published 2014-12-12 · Updated 2014-12-12 · CVE-2014-7250

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions FreeBSD version 5.4 NetBSD versions possibly 2.0 OpenBSD versions possibly 3.6

Description The issue is related to the TCP stack implementation, specifically the session timer, which can be exploited by remote attackers to cause a denial of service through resource consumption by sending crafted packets.

Recommendations For FreeBSD version 5.4, update the TCP stack implementation to properly handle session timers. For NetBSD versions possibly 2.0, consider disabling the vulnerable TCP stack functionality until a proper fix is available. For OpenBSD versions possibly 3.6, restrict access to the TCP stack to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2014-7250

Affected Products

Freebsd

Netbsd

Openbsd

References · 5

• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000134 · Vendor Advisory
• http://jvn.jp/en/jp/JVN07930208/index.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7250 · Security Note
• https://osv.dev/vulnerability/CVE-2014-7250 · Vendor Advisory
• https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=195243 · Note