What is the CVSS score of CVE-2015-4047?

CVE-2015-4047 has a CVSS 2.0 base score of 7.8 (High). CVSS vector: AV:N/AC:L/Au:N/C:N/I:N/A:C. EPSS exploitation probability: 2.7%.

Is there a public PoC exploit available for CVE-2015-4047?

Yes, a public proof-of-concept exploit is available for CVE-2015-4047. Prioritise patching immediately. EPSS: 2.7%.

Ipsec Tools CVE-2015-4047

HIGH

NULL Pointer Dereference (CWE-476)

2015-05-29 cve@mitre.org

Denial Of Service Null Pointer Dereference Ipsec Tools Ubuntu Linux Fedora Big Ip Application Acceleration Manager Big Ip Local Traffic Manager Big Ip Advanced Firewall Manager Big Ip Analytics Big Ip Access Policy Manager Big Ip Application Security Manager Big Ip Domain Name System Big Ip Edge Gateway Big Ip Global Traffic Manager Big Ip Link Controller Big Ip Policy Enforcement Manager Big Ip Protocol Security Manager Big Ip Wan Optimization Manager Big Ip Webaccelerator Big Iq Adc Big Iq Centralized Management Big Iq Cloud Big Iq Cloud And Orchestration Big Iq Device Big Iq Security Enterprise Manager Debian Linux

7.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:N/AC:L/Au:N/C:N/I:N/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:N/I:N/A:C

Attack Vector

Network

Attack Complexity

Low

Confidentiality

None

Integrity

None

Availability

Lifecycle Timeline

CVE Published

May 29, 2015 - 15:59 cve.org

HIGH 7.8

DescriptionCVE.org

racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.

AnalysisAI

racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as NULL Pointer Dereference (CWE-476), which allows attackers to crash the application by dereferencing a null pointer. racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests. Affected products include: Ipsec-Tools, Canonical Ubuntu Linux, Fedoraproject Fedora, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Local Traffic Manager.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Check pointers before dereferencing. Use static analysis tools to detect null pointer paths.