PT-2018-3550 · Freebsd · Freebsd

Maxime Villard

·

Published

2018-04-04

·

Updated

2019-10-03

·

CVE-2018-6918

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions: FreeBSD versions prior to 11.1-STABLE FreeBSD versions prior to 11.1-RELEASE-p9 FreeBSD versions prior to 10.4-STABLE FreeBSD versions prior to 10.4-RELEASE-p8 FreeBSD versions prior to 10.3-RELEASE-p28
Description: The issue is related to the length field of the ipsec option header, which does not count the size of the option header itself. This can cause an infinite loop when the length is zero, allowing a remote attacker to crash the machine by sending an arbitrary packet. The vulnerability can be exploited by a remote attacker to cause a denial of service.
Recommendations: For versions prior to 11.1-STABLE, update to 11.1-STABLE or later. For versions prior to 11.1-RELEASE-p9, update to 11.1-RELEASE-p9 or later. For versions prior to 10.4-STABLE, update to 10.4-STABLE or later. For versions prior to 10.4-RELEASE-p8, update to 10.4-RELEASE-p8 or later. For versions prior to 10.3-RELEASE-p28, update to 10.3-RELEASE-p28 or later.

Fix

Infinite Loop

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2020-04497
CVE-2018-6918
FREEBSD-SA-18_05

Affected Products

Freebsd