Vulnerability Name:

CVE-2018-6918 (CCN-141230)

Assigned:2018-04-04
Published:2018-04-04
Updated:2019-10-03
Summary:In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:7.8 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-835
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2018-6918

Source: FULLDISC
Type: UNKNOWN
20190611 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1

Source: BID
Type: Third Party Advisory, VDB Entry
103666

Source: CCN
Type: BID-103666
FreeBSD CVE-2018-6918 Denial of Service Vulnerability

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1040628

Source: XF
Type: UNKNOWN
freebsd-cve20186918-dos(141230)

Source: BUGTRAQ
Type: UNKNOWN
20190531 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1

Source: FREEBSD
Type: Vendor Advisory
FreeBSD-SA-18:05

Source: CCN
Type: Apple security document HT210090
About the security content of AirPort Base Station Firmware Update 7.9.1

Source: CCN
Type: Apple security document HT210091
About the security content of AirPort Base Station Firmware Update 7.8.1

Source: CONFIRM
Type: UNKNOWN
https://support.apple.com/kb/HT210090

Source: CONFIRM
Type: UNKNOWN
https://support.apple.com/kb/HT210091

Source: CCN
Type: FreeBSD Security Advisory FreeBSD-SA-18:05.ipsec
ipsec crash or denial of service

Vulnerable Configuration:Configuration 1:
  • cpe:/o:freebsd:freebsd:*:*:*:*:*:*:*:* (Version >= 10.0 and < 10.4)
  • OR cpe:/o:freebsd:freebsd:*:*:*:*:*:*:*:* (Version >= 11.0 and < 11.1)

    • Configuration CCN 1:
  • cpe:/o:freebsd:freebsd:10.3:-:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:11.0:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:10.4:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    freebsd freebsd *
    freebsd freebsd *
    freebsd freebsd 10.3 -
    freebsd freebsd 11.0
    freebsd freebsd 10.4