Denial of Service Vulnerability in Nmap - CVE-2018-15173
Summary
ALPINE-CVE-2018-15173: Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted TCP-based service. Affects nmap versions < 7.70-r4. Fixed in 7.70-r4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nmap is a widely used open-source network scanning tool that allows users to discover hosts and services on a computer network. It provides features for network inventory, managing service upgrade schedules, and monitoring host or service uptime. The tool is highly regarded for its versatility and effectiveness in network security assessments. However, a vulnerability has been identified in Nmap versions prior to 7.80, which can lead to a denial of service when the -sV option is used.
Vulnerability Detail
The vulnerability, identified as CVE-2018-15173, arises when Nmap is executed with the -sV option, allowing remote attackers to exploit this feature. By sending specially crafted TCP packets, an attacker can cause the application to consume excessive stack memory, leading to application crashes. This vulnerability poses a significant risk as it can disrupt network scanning operations and potentially allow attackers to exploit other vulnerabilities in the network.
How To Fix
Minimum fixed version
7.70-r4
This is the first release that contains the fix.
sudo apk add --upgrade nmapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the -sV option in Nmap until they have updated to a secure version. This will prevent the vulnerability from being exploited while still allowing for basic scanning operations.
Conclusion
CVE-2018-15173 is a significant denial of service vulnerability in Nmap that can be exploited by remote attackers. Users are strongly advised to update to the latest patched versions to ensure their systems remain secure. Temporary workarounds are available, but updating is the best long-term solution.
See every vulnerability recorded for nmap →
FAQ
CVE-2018-15173 is a vulnerability in Nmap that allows remote attackers to cause a denial of service via crafted TCP packets when the -sV option is used.
Nmap versions prior to 7.80 are affected by this vulnerability, with specific fixes available for various Alpine Linux versions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2018-15173 is 7.5, indicating a high severity level.
If an immediate update is not possible, refrain from using the -sV option in Nmap to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for nmap.
