PT-2014-7881 · Linux+2 · Linux Kernel+2

Published 2014-06-03 · Updated 2014-11-15 · CVE-2014-7284

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.13.x through 3.14.4

Description The issue concerns the predictability of certain network values due to a problem in the net get random once implementation. This predictability can be exploited by remote attackers to spoof or disrupt IP communication by guessing TCP sequence numbers, TCP and UDP port numbers, and IP ID values.

Recommendations For Linux kernel versions 3.13.x through 3.14.4, update to version 3.14.5 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2014-1703

CVE-2014-7284

MGASA-2014-0451

MGASA-2014-0452

MGASA-2014-0455

USN-2288-1

USN-2290-1

USN-2394-1

Affected Products

Alt Linux

Linux Kernel

Ubuntu

References · 62

• 🔥 https://github.com/torvalds/linux/commit/3d4405226d27b3a215e4d03cfa51f536244e5de7 · Exploit
• 🔥 https://web.archive.org/web/20141002163852/http://secondlookforensics.com/ngro-linux-kernel-bug · Exploit
• 🔥 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3d4405226d27b3a215e4d03cfa51f536244e5de7 · Exploit
• https://advisories.mageia.org/MGASA-2014-0451.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7284 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3940 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-7284 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4611 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-7284 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2290-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3145 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4943 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0455 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0452 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0451 · Vendor Advisory