CVE-2018-1000155 Missing authorization in n/a
An attacker can cause denial of service and unauthorized access by exploiting improper authorization in the OpenFlow handshake process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-1000155?
CVE-2018-1000155 is a critical missing authorization vulnerability in n/a, published on 24 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenFlow version 1.0 onwards contains a Denial of Service and Improper authorization vulnerability in OpenFlow handshake: The DPID (DataPath IDentifier) in the features_reply message are inherently trusted by the controller. that can result in Denial of Service, Unauthorized Access, Network Instability. This attack appear to be exploitable via Network connectivity: the attacker must first establish a transport connection with the OpenFlow controller and then initiate the OpenFlow handshake.
Weakness: CWE-863
Which versions are affected by CVE-2018-1000155?
It affects 1 product.
Products include Opennetworking Openflow.
How do I fix CVE-2018-1000155?
No fix has been published for CVE-2018-1000155 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-1000155 being exploited?
There is no known exploitation of CVE-2018-1000155 in the wild and no public exploit code.
Sources
Also known as GHSA-7m23-pgp9-jvm2.