CVE-2014-1453

The NFS server (nfsserver) in FreeBSD 8.3 through 10.0 does not acquire locks in the proper order when converting a directory file handle to a vnode, which allows remote authenticated users to cause a denial of service (deadlock) via vectors involving a thread that uses the correct locking order.

CVSS v2.0 4.0 MEDIUM

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/57760	Vendor Advisory
http://secunia.com/advisories/59034
http://www.debian.org/security/2014/dsa-2952
http://www.freebsd.org/security/advisories/FreeBSD-SA-14:05.nfsserver.asc	Vendor Advisory
http://www.securityfocus.com/bid/66726
http://www.securitytracker.com/id/1030041

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:freebsd:freebsd:8.3:::::::*
	cpe:2.3:o:freebsd:freebsd:8.4:::::::*
	cpe:2.3:o:freebsd:freebsd:9.0:::::::*
	cpe:2.3:o:freebsd:freebsd:9.0:beta1::::::
	cpe:2.3:o:freebsd:freebsd:9.0:beta2::::::
	cpe:2.3:o:freebsd:freebsd:9.0:beta3::::::
	cpe:2.3:o:freebsd:freebsd:9.1:::::::*
	cpe:2.3:o:freebsd:freebsd:9.1:p4::::::
	cpe:2.3:o:freebsd:freebsd:9.1:p5::::::
	cpe:2.3:o:freebsd:freebsd:9.2:::::::*
	cpe:2.3:o:freebsd:freebsd:9.2:prerelease::::::
	cpe:2.3:o:freebsd:freebsd:9.2:rc1::::::
	cpe:2.3:o:freebsd:freebsd:9.2:rc2::::::
	cpe:2.3:o:freebsd:freebsd:10.0:::::::*

History

No history.

Information

Published : 2014-04-16 18:37

Updated : 2019-03-18 15:35

NVD link : CVE-2014-1453

Mitre link : CVE-2014-1453

CVE.ORG link : CVE-2014-1453

JSON object : View

Products Affected

freebsd

freebsd

CWE

CWE-399

Resource Management Errors

{"id": "CVE-2014-1453", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-04-16T18:37:13.413", "references": [{"url": "http://secunia.com/advisories/57760", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/59034", "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2014/dsa-2952", "source": "cve@mitre.org"}, {"url": "http://www.freebsd.org/security/advisories/FreeBSD-SA-14:05.nfsserver.asc", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/66726", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1030041", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-399"}]}], "descriptions": [{"lang": "en", "value": "The NFS server (nfsserver) in FreeBSD 8.3 through 10.0 does not acquire locks in the proper order when converting a directory file handle to a vnode, which allows remote authenticated users to cause a denial of service (deadlock) via vectors involving a thread that uses the correct locking order."}, {"lang": "es", "value": "El servidor NFS (nfsserver) en FreeBSD 8.3 hasta 10.0 no adquiere bloqueos en el orden debido cuando convierte un manejador de archivo de directorio hacia un vnode, lo que permite a usuarios remotos autenticados causar una denegaci\u00f3n de servicios (bloqueo) a trav\u00e9s de vectores que involucran un hilo que utiliza el orden correcto de bloqueo."}], "lastModified": "2019-03-18T15:35:23.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:8.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30C501A1-FE2D-41E7-A5DB-C61D8701B9B4"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:8.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DB4C0E8-8E50-44B1-BE0C-4C261D9E9730"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6BD5BFF-260A-4A9E-B0AA-C8B8386B154E"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:9.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFBAF8FD-8266-46F4-836D-B0A24ECC817D"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:9.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D96D084-E1BC-437D-ACEB-B545078B8549"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:9.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5764F9ED-05B4-4334-AE65-45492DAB9119"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D78E559A-430D-4D50-8A83-58A37D393471"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:9.1:p4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD6B2A2E-6E8C-40D7-B29F-1FC9E8B1076B"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:9.1:p5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0ADB3AF3-5E13-4EC3-AE3C-128DF51E1DF9"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C560926-7789-4052-819D-C36C43C9C61E"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:9.2:prerelease:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "213ECCF5-4FE2-4FE8-B84E-A1C9AA98F1F2"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:9.2:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C52A912B-E7C6-484A-8E15-8208C97B8CB4"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:9.2:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4B097BE-2CA1-4236-AB8F-1151FCC845A9"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA79CE41-D873-4A4A-A20C-83EB8772E5FA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}