CVE-2018-17161: Input Validation

Published Jan 3, 2019

Updated

In FreeBSD before 11.2-STABLE(r348229), 11.2-RELEASE-p7, 12.0-STABLE(r342228), and 12.0-RELEASE-p1, insufficient validation of network-provided data in bootpd may make it possible for a malicious attacker to craft a bootp packet which could cause a stack buffer overflow. It is possible that the buffer overflow could lead to a Denial of Service or remote code execution.

Affected Software

7 affected components

FreeBSD FreeBSD=11.2

FreeBSD FreeBSD=11.2-p2

FreeBSD FreeBSD=11.2-p3

FreeBSD FreeBSD=11.2-p4

FreeBSD FreeBSD=11.2-p5

FreeBSD FreeBSD=11.2-p6

FreeBSD FreeBSD=12.0

Remediation

Patch Available

https://security.freebsd.org/advisories/FreeBSD-SA-18:15.bootpd.asc

Event History

Jan 3, 2019

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-17161?

CVE-2018-17161 has a high severity rating due to potential stack buffer overflow vulnerabilities.

How do I fix CVE-2018-17161?

To fix CVE-2018-17161, update your FreeBSD installation to a patched version or apply the relevant security patches.

Which FreeBSD versions are affected by CVE-2018-17161?

FreeBSD versions 11.2 before patch p7 and 12.0 before patch p1 are affected by CVE-2018-17161.

What type of vulnerability is CVE-2018-17161?

CVE-2018-17161 is a stack buffer overflow vulnerability caused by insufficient validation of network-provided data in bootpd.

Can CVE-2018-17161 be exploited remotely?

Yes, CVE-2018-17161 can be exploited remotely if a malicious attacker crafts a specific bootp packet.