Unscored CVE-2014-7250 EUVD-2014-7121GHSA-x28w-5rvr-6hvm

The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD possibly 3.6, does not properly implement the sessi…

Published Dec 12, 2014 · Updated Aug 6, 2024 · Assigned by jpcert

Description

The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD possibly 3.6, does not properly implement the session timer, which allows remote attackers to cause a denial of service (resource consumption) via crafted packets.

References

JVN#07930208 third-party-advisory
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=195243
JVNDB-2014-000134 third-party-advisory