CVE-2018-6918

{"id": "CVE-2018-6918", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-04-04T14:29:00.293", "references": [{"url": "http://seclists.org/fulldisclosure/2019/Jun/6", "source": "secteam@freebsd.org"}, {"url": "http://www.securityfocus.com/bid/103666", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secteam@freebsd.org"}, {"url": "http://www.securitytracker.com/id/1040628", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secteam@freebsd.org"}, {"url": "https://seclists.org/bugtraq/2019/May/77", "source": "secteam@freebsd.org"}, {"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-18:05.ipsec.asc", "tags": ["Vendor Advisory"], "source": "secteam@freebsd.org"}, {"url": "https://support.apple.com/kb/HT210090", "source": "secteam@freebsd.org"}, {"url": "https://support.apple.com/kb/HT210091", "source": "secteam@freebsd.org"}, {"url": "http://seclists.org/fulldisclosure/2019/Jun/6", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/103666", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1040628", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://seclists.org/bugtraq/2019/May/77", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-18:05.ipsec.asc", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/kb/HT210090", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/kb/HT210091", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash."}, {"lang": "es", "value": "En FreeBSD, en versiones anteriores a 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 y 10.3-RELEASE-p28, el campo length de la cabecera de opci\u00f3n ipsec no cuenta el tama\u00f1o de la propia cabecera de opci\u00f3n. Esto provoca un bucle infinito cuando la longitud es cero. Este problema puede permitir que un atacante remoto que pueda enviar un paquete arbitrario haga que la m\u00e1quina se cierre inesperadamente."}], "lastModified": "2024-11-21T04:11:25.313", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E766E867-C66B-4EAD-8A14-C6D194544438", "versionEndExcluding": "10.4", "versionStartIncluding": "10.0"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "702C5136-33B6-4F0F-8FF7-C2BE3668DE70", "versionEndExcluding": "11.1", "versionStartIncluding": "11.0"}], "operator": "OR"}]}], "sourceIdentifier": "secteam@freebsd.org"}