NVD Vulnerability Detail

CVE-2015-1414

Summary	Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.
Publication Date	Feb. 28, 2015, 12:59 a.m.
Registration Date	Jan. 26, 2021, 2:46 p.m.
Last Update	Nov. 21, 2024, 11:25 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:netgate:pfsense:2.2.1:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:7.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.debian.org/security/2015/dsa-3175	Third Party Advisory
2	http://www.debian.org/security/2015/dsa-3175	Third Party Advisory
3	http://www.securityfocus.com/bid/72777	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/72777	Third Party Advisory VDB Entry
5	http://www.securitytracker.com/id/1031798	Third Party Advisory VDB Entry
6	http://www.securitytracker.com/id/1031798	Third Party Advisory VDB Entry
7	https://kc.mcafee.com/corporate/index?page=content&id=SB10107
8	https://kc.mcafee.com/corporate/index?page=content&id=SB10107
9	https://www.freebsd.org/security/advisories/FreeBSD-SA-15:04.igmp.asc	Vendor Advisory
10	https://www.freebsd.org/security/advisories/FreeBSD-SA-15:04.igmp.asc	Vendor Advisory
11	https://www.pfsense.org/security/advisories/pfSense-SA-15_02.igmp.asc	Third Party Advisory
12	https://www.pfsense.org/security/advisories/pfSense-SA-15_02.igmp.asc	Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

FreeBSD における整数オーバーフローの脆弱性

Title	FreeBSD における整数オーバーフローの脆弱性
Summary	FreeBSD には、整数オーバーフローの脆弱性が存在します。補足情報 : CWE による脆弱性タイプは、CWE-190: Integer Overflow or Wraparound (整数オーバーフローまたはラップアラウンド) と識別されています。 http://cwe.mitre.org/data/definitions/190.html
Possible impacts	第三者により、巧妙に細工された IGMP パケットを介して、メモリ不足となる不正確なサイズ計算および割り当てを誘発されることで、サービス運用妨害 (クラッシュ) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 25, 2015, midnight
Registration Date	March 3, 2015, 12:16 p.m.
Last Update	April 9, 2015, 10:12 a.m.

Affected System

FreeBSD

FreeBSD 10.0 p18 未満の 10.0

FreeBSD 10.1 p6 未満の 10.1

FreeBSD 8.4 p24 未満

FreeBSD 9.3 p10 未満の 9.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-1414	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1414
National Vulnerability Database (NVD)
2	CVE-2015-1414	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1414

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-3175	http://www.debian.org/security/2015/dsa-3175
FreeBSD Security Advisory
2	FreeBSD-SA-15:04.igmp	https://www.freebsd.org/security/advisories/FreeBSD-SA-15:04.igmp.asc
Security Advisory
3	pfSense-SA-15_02.igmp	https://www.pfsense.org/security/advisories/pfSense-SA-15_02.igmp.asc

Change Log

No	Changed Details	Date of change
0	[2015年03月03日] 掲載 [2015年04月09日] ベンダ情報：Electric Sheep Fencing (pfSense-SA-15_02.igmp) を追加	Feb. 17, 2018, 10:37 a.m.