Vulnerability in Bsd

CVE-2014-7250

The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD possibly 3.6, does not properly implement the session timer, which allows remote attackers to cause a denial of service (resource consumption) via crafted packets.

EPSS: 0.047 (90.9th percentile) — read the EPSS interpretation.

Affected products

Bsd — versions 4.3
Freebsd — versions 5.4
Netbsd — versions 2.0
Openbsd — versions 3.6
N/a — versions n/a

Weakness classification (CWE)

CWE-399

References

vultures@jpcert.or.jp (x_refsource_JVN, Vendor Advisory, third-party-advisory)
vultures@jpcert.or.jp (x_refsource_MISC)
vultures@jpcert.or.jp (x_refsource_JVNDB, Vendor Advisory, third-party-advisory)