CVE-2014-3955

Vulnerability

The routed(8) daemon in FreeBSD 8.4 through 10.1-RC2 contains a remote denial of service vulnerability. When an attacker sends a crafted RIP request packet from a source IP address that is not on a directly connected network, the daemon triggers a failed assertion and exits [1]. The flaw is present in all supported FreeBSD versions prior to the patches released on 2014-10-21 [1].

Exploitation

An attacker must be able to send UDP packets to a target host running routed(8). No authentication or prior access to the network is required. The attacker simply sends a single RIP request packet with a source IP that belongs to a network the target is not directly connected to [1]. The daemon then checks the request and hits an assertion that fails, causing the process to terminate [1].

Impact

Successful exploitation results in a denial of service: the routed(8) daemon exits abruptly. The RIP routing service becomes unavailable, potentially disrupting routing table updates on the affected host and its network neighbors [1]. The system itself remains operational, but the loss of RIP can cause connectivity issues in environments relying on this protocol.

Mitigation

FreeBSD released patches on 2014-10-21. Updated packages are available for the following branches: stable/10, releng/10.1 (via patches -RC2-p1, -RC1-p1, -BETA3-p1), releng/10.0 (10.0-RELEASE-p10), stable/9, releng/9.3 (9.3-RELEASE-p3), releng/9.2 (9.2-RELEASE-p13), releng/9.1 (9.1-RELEASE-p20), stable/8, and releng/8.4 (8.4-RELEASE-p17) [1]. There is no workaround listed; users should apply the relevant patches or disable routed(8) if it is not needed [1].