Vulnerability Details : CVE-2015-5674
The routed daemon in FreeBSD 9.3 before 9.3-RELEASE-p22, 10.2-RC2 before 10.2-RC2-p1, 10.2-RC1 before 10.2-RC1-p2, 10.2 before 10.2-BETA2-p3, and 10.1 before 10.1-RELEASE-p17 allows remote authenticated users to cause a denial of service (assertion failure and daemon exit) via a query from a network that is not directly connected.
Vulnerability category: Input validationDenial of service
Products affected by CVE-2015-5674
- cpe:2.3:o:freebsd:freebsd:9.3:*:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:10.1:*:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:10.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-5674
0.74%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 78 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-5674
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:P |
8.0
|
2.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2015-5674
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-5674
-
http://www.securityfocus.com/bid/76244
FreeBSD routed(8) CVE-2015-5674 Denial of Service VulnerabilityThird Party Advisory;VDB Entry
-
https://www.freebsd.org/security/advisories/FreeBSD-SA-15:19.routed.asc
Mitigation;Vendor Advisory
-
http://www.securitytracker.com/id/1033185
FreeBSD routed(8) RIP Query Processing Flaw Lets Remote Users Cause the Target Service to Crash - SecurityTrackerThird Party Advisory;VDB Entry
Jump to