SB2023103125 - Denial of service in WireGuard client for Windows

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023103125

SB2023103125 - Denial of service in WireGuard client for Windows

Published: October 31, 2023

Security Bulletin ID SB2023103125
CSH Severity
Medium
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Adjecent network
Highest impact Partial DoS

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Externally Controlled Reference to a Resource in Another Sphere (CVE-ID: CVE-2023-35838)

CWE-ID: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to block access to certain resources.

The vulnerability exists due to the way WireGuard handles non-RFC1918 IP addresses. A remote attacker can trick the victim into blocking IP traffic to selected IP addresses and services even while the VPN is enabled.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References