{"containers": {"cna": {"affected": [{"product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"status": "affected", "version": "All supported versions of FreeBSD."}]}], "datePublic": "2018-04-04T00:00:00", "descriptions": [{"lang": "en", "value": "In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash."}], "problemTypes": [{"descriptions": [{"description": "Kernel crash or denial of service", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-06-20T20:06:04", "orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd"}, "references": [{"name": "1040628", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1040628"}, {"name": "FreeBSD-SA-18:05", "tags": ["vendor-advisory", "x_refsource_FREEBSD"], "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-18:05.ipsec.asc"}, {"name": "103666", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/103666"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.apple.com/kb/HT210090"}, {"name": "20190531 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "https://seclists.org/bugtraq/2019/May/77"}, {"name": "20190611 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2019/Jun/6"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.apple.com/kb/HT210091"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secteam@freebsd.org", "DATE_PUBLIC": "2018-04-04T00:00:00", "ID": "CVE-2018-6918", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "FreeBSD", "version": {"version_data": [{"version_value": "All supported versions of FreeBSD."}]}}]}, "vendor_name": "FreeBSD"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Kernel crash or denial of service"}]}]}, "references": {"reference_data": [{"name": "1040628", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1040628"}, {"name": "FreeBSD-SA-18:05", "refsource": "FREEBSD", "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-18:05.ipsec.asc"}, {"name": "103666", "refsource": "BID", "url": "http://www.securityfocus.com/bid/103666"}, {"name": "https://support.apple.com/kb/HT210090", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT210090"}, {"name": "20190531 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/May/77"}, {"name": "20190611 APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2019/Jun/6"}, {"name": "https://support.apple.com/kb/HT210091", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT210091"}]}}}}, "cveMetadata": {"assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "assignerShortName": "freebsd", "cveId": "CVE-2018-6918", "datePublished": "2018-04-04T00:00:00", "dateReserved": "2018-02-12T00:00:00", "dateUpdated": "2019-06-20T20:06:04", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*", "matchCriteriaId": "E766E867-C66B-4EAD-8A14-C6D194544438", "versionEndExcluding": "10.4", "versionStartIncluding": "10.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*", "matchCriteriaId": "702C5136-33B6-4F0F-8FF7-C2BE3668DE70", "versionEndExcluding": "11.1", "versionStartIncluding": "11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash."}, {"lang": "es", "value": "En FreeBSD, en versiones anteriores a 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 y 10.3-RELEASE-p28, el campo length de la cabecera de opci\u00f3n ipsec no cuenta el tama\u00f1o de la propia cabecera de opci\u00f3n. Esto provoca un bucle infinito cuando la longitud es cero. Este problema puede permitir que un atacante remoto que pueda enviar un paquete arbitrario haga que la m\u00e1quina se cierre inesperadamente."}], "id": "CVE-2018-6918", "lastModified": "2019-10-03T00:03:26.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.8, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-04-04T14:29:00.293", "references": [{"source": "secteam@freebsd.org", "url": "http://seclists.org/fulldisclosure/2019/Jun/6"}, {"source": "secteam@freebsd.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/103666"}, {"source": "secteam@freebsd.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1040628"}, {"source": "secteam@freebsd.org", "url": "https://seclists.org/bugtraq/2019/May/77"}, {"source": "secteam@freebsd.org", "tags": ["Vendor Advisory"], "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-18:05.ipsec.asc"}, {"source": "secteam@freebsd.org", "url": "https://support.apple.com/kb/HT210090"}, {"source": "secteam@freebsd.org", "url": "https://support.apple.com/kb/HT210091"}], "sourceIdentifier": "secteam@freebsd.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}