#VU11528 Infinite loop in FreeBSD - CVE-2018-6918
Published: April 4, 2018
Vulnerability identifier: #VU11528
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2018-6918
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
FreeBSD
FreeBSD
Software vendor:
FreeBSD Foundation
FreeBSD Foundation
Description
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to the length field of the option header does not count the size of the option header itself and pointer/offset mistakes in the handling of IPv4 options. A remote attacker can trigger infinite loop and cause the service to crash.
The weakness exists due to the length field of the option header does not count the size of the option header itself and pointer/offset mistakes in the handling of IPv4 options. A remote attacker can trigger infinite loop and cause the service to crash.
Remediation
Install update from vendor's website.