CVE-2014-2537 : Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denial of servi

Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.

Published 2014-03-18 17:04:19

Updated 2014-04-01 06:29:37

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2014-2537

EPSS FAQ

1.29%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 84 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-2537

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.8	HIGH	AV:N/AC:L/Au:N/C:N/I:N/A:C	10.0	6.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete

References for CVE-2014-2537

http://www.securitytracker.com/id/1029920

Sophos UTM TCP Processing Flaw Lets Remote Users Deny Service - SecurityTracker
http://www.securityfocus.com/bid/66231

Sophos UTM Memory Leak Remote Denial of Service Vulnerability
http://blogs.sophos.com/2014/02/20/utm-up2date-9-109/

UTM Up2Date 9.109 Released – Sophos News
Patch;Vendor Advisory

Products affected by CVE-2014-2537

Sophos » Unified Threat Management Software
Versions up to, including, (<=) 9.108
cpe:2.3:a:sophos:unified_threat_management_software:*:*:*:*:*:*:*:*
Matching versions
Sophos » Unified Threat Management Software » Version: 9.007
cpe:2.3:a:sophos:unified_threat_management_software:9.007:*:*:*:*:*:*:*
Matching versions
Sophos » Unified Threat Management Software » Version: 8.3
cpe:2.3:a:sophos:unified_threat_management_software:8.3:*:*:*:*:*:*:*
Matching versions
Sophos » Unified Threat Management Software » Version: 9.107
cpe:2.3:a:sophos:unified_threat_management_software:9.107:*:*:*:*:*:*:*
Matching versions
Sophos » Unified Threat Management » Version: 120
cpe:2.3:h:sophos:unified_threat_management:120:*:*:*:*:*:*:*
Matching versions
Sophos » Unified Threat Management » Version: 320
cpe:2.3:h:sophos:unified_threat_management:320:*:*:*:*:*:*:*
Matching versions
Sophos » Unified Threat Management » Version: 525
cpe:2.3:h:sophos:unified_threat_management:525:*:*:*:*:*:*:*
Matching versions
Sophos » Unified Threat Management » Version: 110
cpe:2.3:h:sophos:unified_threat_management:110:*:*:*:*:*:*:*
Matching versions
Sophos » Unified Threat Management » Version: 625
cpe:2.3:h:sophos:unified_threat_management:625:*:*:*:*:*:*:*
Matching versions
Sophos » Unified Threat Management » Version: 220
cpe:2.3:h:sophos:unified_threat_management:220:*:*:*:*:*:*:*
Matching versions
Sophos » Unified Threat Management » Version: 425
cpe:2.3:h:sophos:unified_threat_management:425:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2014-2537

Exploit prediction scoring system (EPSS) score for CVE-2014-2537

CVSS scores for CVE-2014-2537

CWE ids for CVE-2014-2537

References for CVE-2014-2537

Products affected by CVE-2014-2537