CVE-2014-7250 The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD possibly 3.6, does not properly implement the session timer, which allows remote attackers to cause a denial of....
MediumCVSS 5.0
EPSS 7.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD possibly 3.6, does not properly implement the session timer, which allows remote attackers to cause a denial of service (resource consumption) via crafted packets.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/kfreebsd-10(Debian:10) | All versions | No fix listed |
| debian/kfreebsd-10(Debian:10) | = 10.3~svn300087+ds1-1 | No fix listed |
| debian/kfreebsd-10(Debian:10) | = 10.3~svn300087-5 | No fix listed |
| debian/kfreebsd-10(Debian:10) | = 10.3~svn300087-6 | No fix listed |
| bsd | = 4.3 | No fix listed |
| freebsd | = 5.4 | No fix listed |
| netbsd | = 2.0 | No fix listed |
| OpenBSD | = 3.6 | No fix listed |
References
- JVN#07930208 third-party-advisory vendor-advisory
- JVNDB-2014-000134 third-party-advisory vendor-advisory
- bugs.freebsd.org issue-tracking