In FreeBSD 11.3-PRERELEASE and 12.0-STABLE before r347591, 11.2-RELEASE before 11.2-RELEASE-p10, and 12.0-RELEASE before 12.0-RELEASE-p4, a bug in the pf IPv6 fragment reassembly logic incorrectly uses the last extension header offset from the last received packet instead of the first packet allowing maliciously crafted IPv6 packets to cause a crash or potentially bypass the packet filter.

A bug in the pf(4) IPv6 fragment reassembly logic incorrectly uses the last extension header offset from the last received packet instead of from the first packet. Impact : Malicious IPv6 packets with different IPv6 extensions could cause a kernel panic or potentially a filtering rule bypass.

This Solaris system is missing necessary patches to address critical security updates :

  - Vulnerability in the Oracle Solaris product of Oracle     Sun Systems Products Suite (component: Filesystem).
    Supported versions that are affected are 11.4 and 10.
    Easily exploitable vulnerability allows low privileged     attacker with logon to the infrastructure where Oracle     Solaris executes to compromise Oracle Solaris.
    Successful attacks require human interaction from a     person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Oracle     Solaris. (CVE-2019-2804)

  - Vulnerability in the Oracle Solaris product of Oracle     Sun Systems Products Suite (component: Kernel).
    Supported versions that are affected are 11.4 and 11.3.
    Easily exploitable vulnerability allows unauthenticated     attacker with network access via IPv6 to compromise     Oracle Solaris. Successful attacks of this vulnerability     can result in unauthorized creation, deletion or     modification access to critical data or all Oracle     Solaris accessible data and unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of Oracle Solaris. (CVE-2019-5597)

This Solaris system is missing necessary patches to address a critical security update :

  - Vulnerability in the Oracle Solaris product of Oracle     Sun Systems Products Suite (component: Kernel).
    Supported versions that are affected are 11.4 and 11.3.
    Easily exploitable vulnerability allows unauthenticated     attacker with network access via IPv6 to compromise     Oracle Solaris. Successful attacks of this vulnerability     can result in unauthorized creation, deletion or     modification access to critical data or all Oracle     Solaris accessible data and unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of Oracle Solaris. (CVE-2019-5597)

The version of the FreeBSD kernel running on the remote host is 11.x prior to 11.2-RELEASE-p10 or 12.x prior to 12.0-RELEASE-p4. It is, therefore, affected by multiple vulnerabilities in pf.

ID	Name	Product	Family	Severity
127543	FreeBSD : FreeBSD -- IPv6 fragment reassembly panic in pf(4) (3d02520d-b309-11e9-a87f-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	critical
126768	Oracle Solaris Critical Patch Update : jul2019_SRU11_4_8_5_0	Nessus	Solaris Local Security Checks	critical
126764	Oracle Solaris Critical Patch Update : jul2019_SRU11_3_36_13_0	Nessus	Solaris Local Security Checks	critical
125632	FreeBSD 11.x < 11.2-RELEASE-p10 / 12.x < 12.0-RELEASE-p4 Multiple vulnerabilities in pf	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2019-5597

critical

Tenable Plugins

critical

critical

critical

critical