CVE-2015-5674: Input Validation

Published Feb 5, 2018

Updated

The routed daemon in FreeBSD 9.3 before 9.3-RELEASE-p22, 10.2-RC2 before 10.2-RC2-p1, 10.2-RC1 before 10.2-RC1-p2, 10.2 before 10.2-BETA2-p3, and 10.1 before 10.1-RELEASE-p17 allows remote authenticated users to cause a denial of service (assertion failure and daemon exit) via a query from a network that is not directly connected.

Affected Software

3 affected components

FreeBSD FreeBSD=9.3

FreeBSD FreeBSD=10.1

FreeBSD FreeBSD=10.2

Event History

Feb 5, 2018

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-5674?

CVE-2015-5674 has a medium severity level due to its potential to cause denial of service for remote authenticated users.

How do I fix CVE-2015-5674?

To fix CVE-2015-5674, update FreeBSD to version 9.3-RELEASE-p22, 10.1-RELEASE-p17, or later versions as applicable.

Which versions of FreeBSD are affected by CVE-2015-5674?

FreeBSD versions 9.3 before 9.3-RELEASE-p22, 10.1 before 10.1-RELEASE-p17, and 10.2 before 10.2-BETA2-p3 are affected by CVE-2015-5674.

What type of attack does CVE-2015-5674 describe?

CVE-2015-5674 describes a denial of service attack that can occur when a remote authenticated user sends a specific query to the routed daemon.

Is CVE-2015-5674 exploitable over the network?

Yes, CVE-2015-5674 is exploitable over the network, specifically by remote authenticated users.