CVE-2014-0101

Advisory lineage Upstream: 0 Downstream: 7
Modified
Published: 11 Mar 2014, 01:00
Last modified:06 Aug 2024, 09:05

Vulnerability Summary

Overall Risk (default)
medium
32/100
CVSS Score
7.8 HIGH
v2.0 (nvd)
EPSS Score
3.09% LOW
3% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Mar 2014, 01:00
Published
Vulnerability first disclosed
06 Aug 2024, 09:05
Last Modified
Vulnerability information updated

Description

The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.

CVSS Metrics

  • v2.0•HIGH•Score: 7.8AV:N/AC:L/Au:N/C:N/I:N/A:C

EPSS Trends

Current EPSS score: 3.09%• Percentile: 87%

Techniques & Countermeasures

  • CWE-476•NULL Pointer Dereference

    The product dereferences a pointer that it expects to be valid but is NULL.

Affected Systems

  • canonical•ubuntu_linux

    10.04

  • f5•big-ip_access_policy_manager

    ≥ 11.1.0, ≤ 11.5.3

  • f5•big-ip_advanced_firewall_manager

    ≥ 11.3.0, ≤ 11.5.3

  • f5•big-ip_analytics

    ≥ 11.1.0, ≤ 11.5.3

  • f5•big-ip_application_acceleration_manager

    ≥ 11.4.0, ≤ 11.5.3

  • f5•big-ip_application_security_manager

    ≥ 11.1.0, ≤ 11.5.3

  • f5•big-ip_edge_gateway

    ≥ 11.1.0, ≤ 11.3.0

  • f5•big-ip_enterprise_manager

    ≥ 2.1.0, ≤ 2.3.0 | ≥ 3.0.0, ≤ 3.1.1

  • f5•big-ip_global_traffic_manager

    ≥ 11.1.0, ≤ 11.5.3

  • f5•big-ip_link_controller

    ≥ 11.1.0, ≤ 11.5.3

  • f5•big-ip_local_traffic_manager

    ≥ 11.1.0, ≤ 11.5.3

  • f5•big-ip_policy_enforcement_manager

    ≥ 11.3.0, ≤ 11.5.3

  • f5•big-ip_protocol_security_module

    ≥ 11.1.0, ≤ 11.4.1

  • f5•big-ip_wan_optimization_manager

    ≥ 11.1.0, ≤ 11.3.0

  • f5•big-ip_webaccelerator

    ≥ 11.1.0, ≤ 11.3.0

  • f5•big-iq_adc

    4.5.0

  • f5•big-iq_centralized_management

    4.6.0

  • f5•big-iq_cloud

    ≥ 4.0.0, ≤ 4.5.0

  • f5•big-iq_device

    ≥ 4.2.0, ≤ 4.5.0

  • f5•big-iq_security

    ≥ 4.0.0, ≤ 4.5.0

  • linux•linux_kernel

    ≥ 2.6.24, < 3.2.56 | ≥ 3.3, < 3.4.84 | ≥ 3.5, < 3.10.34 | ≥ 3.11, < 3.12.15 | ≥ 3.13, < 3.13.7

  • redhat•enterprise_linux_desktop

    6.0

  • redhat•enterprise_linux_eus

    6.3 | 6.4 | 6.5

  • redhat•enterprise_linux_server

    6.0

  • redhat•enterprise_linux_server_aus

    6.4 | 6.5

  • redhat•enterprise_linux_server_tus

    6.5

  • redhat•enterprise_linux_workstation

    6.0

References (12)