Is CVE-2015-4047 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 10%.

What products does CVE-2015-4047 affect?

Tracked products affected include Ubuntu. Check the version you run to see whether it is affected.

How do I fix CVE-2015-4047?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2015-4047

Q: What is CVE-2015-4047?

CVE-2015-4047 is a high-severity software vulnerability (CWE-476) with a CVSS score of 7.8. racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.

HIGH severity · CVSS 7.8 · CWE-476

7.8CVSS HIGH

Summary

racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges required—

User interaction—

Confidentiality impactNone

Integrity impactNone

Availability impact—

Exploit probability (EPSS)10%

AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products we track (1)

Ubuntu

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159482.htmlAdvisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159549.htmlAdvisory
http://packetstormsecurity.com/files/131992/IPsec-Tools-0.8.2-Denial-Of-Service.htmlAdvisory
http://www.debian.org/security/2015/dsa-3272Advisory
http://www.openwall.com/lists/oss-security/2015/05/21/11Advisory
http://seclists.org/fulldisclosure/2015/May/81Advisory
http://seclists.org/fulldisclosure/2015/May/83Advisory
http://www.openwall.com/lists/oss-security/2015/05/20/1Advisory