PT-2017-6487 · Freebsd · Freebsd

Patrick Kelsey · Published 2017-07-25 · Updated 2019-03-20 · CVE-2015-1417

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD versions prior to 10.2-PRERELEASE FreeBSD versions prior to 10.1-RELEASE-p16 FreeBSD versions prior to 9.3-STABLE FreeBSD versions prior to 9.3-RELEASE-p21 FreeBSD versions prior to 8.4-STABLE FreeBSD versions prior to 8.4-RELEASE-p35

Description The issue allows remote attackers to cause a denial of service by consuming mbuf via multiple concurrent TCP connections on systems with VNET enabled and at least 16 VNET instances.

Recommendations For versions prior to 10.2-PRERELEASE, update to 10.2-PRERELEASE or later. For versions prior to 10.1-RELEASE-p16, update to 10.1-RELEASE-p16 or later. For versions prior to 9.3-STABLE, update to 9.3-STABLE or later. For versions prior to 9.3-RELEASE-p21, update to 9.3-RELEASE-p21 or later. For versions prior to 8.4-STABLE, update to 8.4-STABLE or later. For versions prior to 8.4-RELEASE-p35, update to 8.4-RELEASE-p35 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2015-1417

Affected Products

Freebsd

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-1417 · Security Note
• https://osv.dev/vulnerability/CVE-2015-1417 · Vendor Advisory
• https://freebsd.org/security/advisories/FreeBSD-SA-15:15.tcp.asc · Vendor Advisory
• http://securitytracker.com/id/1033111 · Note
• http://securityfocus.com/bid/76112 · Note