Lucene search

CertccCVE-2015-7988

HistoryJun 26, 2016 - 1:59 a.m.

CVE-2015-7988

2016-06-2601:59:01

certcc

web.nvd.nist.gov

cve-2015-7988

mdnsresponder

handle_regservice_request

remote code execution

denial of service

null pointer dereference

vulnerability

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.015

Percentile

87.2%

JSON

The handle_regservice_request function in mDNSResponder before 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.

Affected configurations

Nvd

Node

appleiphone_osRange9.0–9.1

applemac_os_xRange10.9–10.9.5

applemac_os_xRange10.10.0–10.10.5

applemac_os_xRange10.11.0–10.11.1

applewatchosRange<2.1

Node

appleairport_base_station_firmwareRange7.6–7.6.7

appleairport_base_station_firmwareRange7.7–7.7.7

AND

appleairport_base_station

Node

applemdnsresponderRange<625.41.2

VendorProductVersionCPE
appleiphone_os*cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
applemac_os_x*cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
applewatchos*cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
appleairport_base_station_firmware*cpe:2.3:o:apple:airport_base_station_firmware:*:*:*:*:*:*:*:*
appleairport_base_station*cpe:2.3:h:apple:airport_base_station:*:*:*:*:*:*:*:*
applemdnsresponder*cpe:2.3:a:apple:mdnsresponder:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	iphone_os	*	cpe:2.3:o:apple:iphone_os::::::::
apple	mac_os_x	*	cpe:2.3:o:apple:mac_os_x::::::::
apple	watchos	*	cpe:2.3:o:apple:watchos::::::::
apple	airport_base_station_firmware	*	cpe:2.3:o:apple:airport_base_station_firmware::::::::
apple	airport_base_station	*	cpe:2.3:h:apple:airport_base_station::::::::
apple	mdnsresponder	*	cpe:2.3:a:apple:mdnsresponder::::::::

References

www.kb.cert.org/vuls/id/143335

www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

www.securitytracker.com/id/1036181

support.apple.com/HT206846

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.015

Percentile

87.2%

JSON

Related for CVE-2015-7988