Vulnerability Description
A stack-based buffer over-read exists in setbit() at iptree.h of TCPFLOW 1.5.0, due to received incorrect values causing incorrect computation, leading to denial of service during an address_histogram call or a get_histogram call.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Digitalcorpora | Tcpflow | 1.5.0 |
| Fedoraproject | Fedora | 28 |
| Canonical | Ubuntu Linux | 16.04 |
Related Weaknesses (CWE)
References
- https://github.com/simsong/tcpflow/issues/195ExploitPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://usn.ubuntu.com/3955-1/Third Party Advisory
- https://github.com/simsong/tcpflow/issues/195ExploitPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://usn.ubuntu.com/3955-1/Third Party Advisory
FAQ
What is CVE-2018-18409?
CVE-2018-18409 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A stack-based buffer over-read exists in setbit() at iptree.h of TCPFLOW 1.5.0, due to received incorrect values causing incorrect computation, leading to denial of service during an address_histogram...
How severe is CVE-2018-18409?
CVE-2018-18409 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-18409?
Check the references section above for vendor advisories and patch information. Affected products include: Digitalcorpora Tcpflow, Fedoraproject Fedora, Canonical Ubuntu Linux.