CVE-2014-8475 - FreeBSD 9.1, 9.2, and 10.0, when compiling OpenSSH with Kerberos support, uses incorrect library ord

CVE-2014-8475

Summary

FreeBSD 9.1, 9.2, and 10.0, when compiling OpenSSH with Kerberos support, uses incorrect library ordering when linking sshd, which causes symbols to be resolved incorrectly and allows remote attackers to cause a denial of service (sshd deadlock and prevention of new connections) by ending multiple connections before authentication is completed.

References

Vulnerable Configurations

cpe:2.3:o:freebsd:freebsd:9.1:*:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:9.1:*:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:9.2:*:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:9.2:*:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:10.0:*:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:10.0:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 08-09-2017 - 01:29)
Impact:
Exploitability:

CWE

CWE-17

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

refmap via4

bid	70913
freebsd	FreeBSD-SA-14:24
misc	http://packetstormsecurity.com/files/128972/FreeBSD-Security-Advisory-sshd-Denial-Of-Service.html
sectrack	1031168
secunia	61440
xf	freebsd-cve20148475-dos(98491)

Last major update

08-09-2017 - 01:29

Published

18-11-2014 - 15:59

Last modified

08-09-2017 - 01:29