CVE-2018-6918: High severity Apple AirPort Base Station Firmware Update vulnerability

Q: What is the severity of CVE-2018-6918?

CVE-2018-6918 is a denial of service vulnerability that can disrupt the functioning of affected devices.

Q: How do I fix CVE-2018-6918?

To fix CVE-2018-6918, update the AirPort Base Station Firmware to version 7.9.1 or 7.8.1 or ensure your FreeBSD version is updated to the necessary secure releases.

Q: Which devices are affected by CVE-2018-6918?

CVE-2018-6918 affects Apple AirPort Base Station Firmware as well as certain versions of FreeBSD prior to 11.1 and 10.4.

Q: What symptoms indicate an attack related to CVE-2018-6918?

Symptoms of an attack exploiting CVE-2018-6918 may include unexpected downtime or unresponsiveness of the network services on affected devices.

Q: Is there a workaround for CVE-2018-6918?

There are no specific workarounds for CVE-2018-6918; upgrading to the patched firmware is required to mitigate the vulnerability.

Published Apr 4, 2018

Updated

AirPort Base Station Firmware. A denial of service issue was addressed with improved validation.

Other sources

In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash.

Credit

Maxime Villard

Affected Software

4 affected componentsFixes available

Apple AirPort Base Station Firmware Update<7.9.1

7.9.1

Apple AirPort Base Station Firmware Update<7.8.1

7.8.1

FreeBSD FreeBSD>=10.0<10.4

FreeBSD FreeBSD>=11.0<11.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apple AirPort Base Station Firmware Update to a version that resolves this vulnerability.
Fixed in 7.9.1
Upgrade
Upgrade Apple AirPort Base Station Firmware Update to a version that resolves this vulnerability.
Fixed in 7.8.1
Upgrade
Upgrade FreeBSD to a version that resolves this vulnerability.
Fixed in 11.1-STABLE
Upgrade
Upgrade FreeBSD to a version that resolves this vulnerability.
Fixed in 11.1-RELEASE-p9
Upgrade
Upgrade FreeBSD to a version that resolves this vulnerability.
Fixed in 10.4-STABLE
Upgrade
Upgrade FreeBSD to a version that resolves this vulnerability.
Fixed in 10.4-RELEASE-p8
Upgrade
Upgrade FreeBSD to a version that resolves this vulnerability.
Fixed in 10.3-RELEASE-p28

Event History

Apr 4, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Data Sourced

via NVD·02:29 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2018-6918?