Snapgear Lite+ Firewall 1.5.3/1.5.4 IP Options denial of service
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 5.3 | $0-$5k | 0.00 |
Summary
A vulnerability classified as problematic has been found in Snapgear Lite+ Firewall 1.5.3/1.5.4. Affected by this issue is some unknown functionality of the component IP Options Handler. This manipulation causes denial of service. This vulnerability appears as CVE-2002-0604. There is no available exploit.
Details
A vulnerability has been found in Snapgear Lite+ Firewall 1.5.3/1.5.4 (Firewall Software) and classified as problematic. Affected by this vulnerability is some unknown processing of the component IP Options Handler. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. The summary by CVE is:
Snapgear Lite+ firewall 1.5.3 and 1.5.4 allows remote attackers to cause a denial of service (crash) via a large number of packets with malformed IP options.
The weakness was presented 06/18/2002 by Peter Gründl (ASAN) (Website). It is possible to read the advisory at marc.theaimsgroup.com. This vulnerability is known as CVE-2002-0604. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
The vulnerability is also documented in the databases at X-Force (8988) and SecurityFocus (BID 4660†). See VDB-18281 and VDB-18282 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Product
Type
Vendor
Name
Version
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.3VulDB Meta Temp Score: 5.3
VulDB Base Score: 5.3
VulDB Temp Score: 5.3
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Denial of serviceCWE: CWE-404
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: no mitigation knownStatus: 🔍
0-Day Time: 🔍
Timeline
05/02/2002 🔍06/18/2002 🔍
06/18/2002 🔍
07/11/2014 🔍
04/12/2019 🔍
Sources
Advisory: marc.theaimsgroup.comResearcher: Peter Gründl (ASAN)
Status: Not defined
Confirmation: 🔍
CVE: CVE-2002-0604 (🔍)
GCVE (CVE): GCVE-0-2002-0604
GCVE (VulDB): GCVE-100-18283
X-Force: 8988 - SnapGear LITE+ VPN router malformed IP options denial of service
SecurityFocus: 4660 - Snapgear Lite+ Firewall IP-OPTIONS Denial of Service Vulnerability
See also: 🔍
Entry
Created: 07/11/2014 14:11Updated: 04/12/2019 16:14
Changes: 07/11/2014 14:11 (56), 04/12/2019 16:14 (1)
Complete: 🔍
Cache ID: 216::103
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.