CVE-2014-3955: Input Validation

Published Oct 27, 2014

Updated

routed in FreeBSD 8.4 through 10.1-RC2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an RIP request from a source not on a directly connected network.

Affected Software

21 affected components

FreeBSD FreeBSD=8.4

FreeBSD FreeBSD=9.0

FreeBSD FreeBSD=9.0-beta1

FreeBSD FreeBSD=9.0-beta2

FreeBSD FreeBSD=9.0-beta3

FreeBSD FreeBSD=9.1

FreeBSD FreeBSD=9.1-p4

FreeBSD FreeBSD=9.1-p5

FreeBSD FreeBSD=9.2

FreeBSD FreeBSD=9.2-prerelease

FreeBSD FreeBSD=9.2-rc1

FreeBSD FreeBSD=9.2-rc2

FreeBSD FreeBSD=9.3

FreeBSD FreeBSD=9.3-rc1

FreeBSD FreeBSD=9.3-rc2

FreeBSD FreeBSD=10.0

FreeBSD FreeBSD=10.0-rc1

FreeBSD FreeBSD=10.0-rc2

FreeBSD FreeBSD=10.1

FreeBSD FreeBSD=10.1-rc1

FreeBSD FreeBSD=10.1-rc2

Remediation

Patch Available

https://www.freebsd.org/security/advisories/FreeBSD-SA-14:21.routed.asc

Event History

Oct 27, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3955?

CVE-2014-3955 has a severity rating that indicates it can lead to denial of service due to an assertion failure in the routed daemon.

How do I fix CVE-2014-3955?

To remediate CVE-2014-3955, you should upgrade your FreeBSD system to a version where this vulnerability is patched, following the guidance provided in FreeBSD security advisories.

What versions of FreeBSD are affected by CVE-2014-3955?

CVE-2014-3955 affects FreeBSD versions from 8.4 to 10.1-RC2.

What is the impact of CVE-2014-3955?

The impact of CVE-2014-3955 is that remote attackers can exploit it to cause a denial of service, resulting in the routed daemon exiting.

Is CVE-2014-3955 exploitable from a remote location?

Yes, CVE-2014-3955 can be exploited by remote attackers sending RIP requests from sources not on a directly connected network.