Unscored severity · published Dec 12, 2014
CVE-2014-7250
The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD possibly 3.6, does not properly implement the session timer, which allows remote attackers…
–
CVSS
4.7%
EPSS
No
On KEV
Description
The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD possibly 3.6, does not properly implement the session timer, which allows remote attackers to cause a denial of service (resource consumption) via crafted packets.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.7% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
Bsd · Bsd
4.3 · source: NVD
FR
Freebsd · Freebsd
5.4 · source: NVD
NE
Netbsd · Netbsd
2.0 · source: NVD
OP
Openbsd · Openbsd
3.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7250
jvn.jp
http://jvn.jp/en/jp/JVN07930208/index.html
jvndb.jvn.jp
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000134
bugs.freebsd.org
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=195243
More from Bsd
–
CVE-2008-4609
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to…
–
CVE-2001-0670
Buffer overflow in BSD line printer daemon (in.lpd or lpd) in various BSD-based operating systems allows remote attackers to execute arbitrary code via an incomplete print job…
–
CVE-1999-1102
lpr on SunOS 4.1.1, BSD 4.3, A/UX 2.0.1, and other BSD-based operating systems allows local users to create or overwrite arbitrary files via a symlink attack that is triggered…
–
CVE-1999-1394
BSD 4.4 based operating systems, when running at security level 1, allow the root user to clear the immutable and append-only flags for files by unmounting the file system and…
–
CVE-1999-1214
The asynchronous I/O facility in 4.4 BSD kernel does not check user credentials when setting the recipient of I/O notification, which allows local users to cause a denial of…