CVE-2020-3840
Last modified
CVE-2020-3840 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking. EPSS estimates a 1.14% chance of exploitation in the next 30 days.
Description
An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1. Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apple | Ipados | < 13.3.1 |
| Apple | Iphone Os | < 13.3.1 |
| Apple | Mac Os X | < 10.15.3 |
| Apple | Tvos | < 13.3.1 |
References
- https://support.apple.com/HT210918Release Notes, Vendor Advisory
- https://support.apple.com/HT210919Release Notes, Vendor Advisory
- https://support.apple.com/HT210920Release Notes, Vendor Advisory
- https://support.apple.com/HT210918Release Notes, Vendor Advisory
- https://support.apple.com/HT210919Release Notes, Vendor Advisory
- https://support.apple.com/HT210920Release Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-3840?
How severe is CVE-2020-3840?
How do I fix CVE-2020-3840?
Are you affected by CVE-2020-3840?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST