Vulnerability Report

CVE-2018-14880

Title: F5 Big-Ip Application Security Manager Memory Corruption

Memory Corruption

Proof Of Concept

PoC Available for CVE-2018-14880

CWE Category CWE-125
Published Date Oct 03, 2019
Modified Date Nov 21, 2024
Exploit Status Available
Score 7.5 CVSS v3.1
Exploit Probability (EPSS)
5.34%

Vulnerability Summary

CVE-2018-14880: The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().

Impacted Vendors

F
f5 17
A
avaya 1
N
netgain-systems 1
L
lbl 1
R
redhat 1
T
tcpdump 1

Reference Links

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html http://seclists.org/fulldisclosure/2019/Dec/26 https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES https://github.com/the-tcpdump-group/tcpdump/commit/e01c9bf76740802025c9328901b55ee4a0c49ed6 https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/ https://seclists.org/bugtraq/2019/Dec/23 https://seclists.org/bugtraq/2019/Oct/28 https://security.netapp.com/advisory/ntap-20200120-0001/ https://support.apple.com/kb/HT210788 https://support.f5.com/csp/article/K56551263?utm_source=f5support&amp%3Butm_medium=RSS https://usn.ubuntu.com/4252-1/ https://usn.ubuntu.com/4252-2/ https://www.debian.org/security/2019/dsa-4547 http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html http://seclists.org/fulldisclosure/2019/Dec/26 https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES https://github.com/the-tcpdump-group/tcpdump/commit/e01c9bf76740802025c9328901b55ee4a0c49ed6 https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/ https://seclists.org/bugtraq/2019/Dec/23 https://seclists.org/bugtraq/2019/Oct/28 https://security.netapp.com/advisory/ntap-20200120-0001/ https://support.apple.com/kb/HT210788 https://support.f5.com/csp/article/K56551263?utm_source=f5support&amp%3Butm_medium=RSS https://usn.ubuntu.com/4252-1/ https://usn.ubuntu.com/4252-2/ https://www.debian.org/security/2019/dsa-4547
CVSS v3.1
Source Entity [email protected]
Severity HIGH
7.5
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0
Source Entity [email protected]
Severity MEDIUM
5.0
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:L/Au:N/C:N/I:N/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2018-14880 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/Trinadh465/external_tcpdump_CVE-2018-14880
View Code
MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Stack

No specific products linked.