CVE-2018-25423: Buffer Overflow Denial of Service in Arm Whois 3.11

Technical summary

CVE-2018-25423 is a classic stack-based or heap-based buffer overflow (CWE-120) in Arm Whois 3.11. The vulnerability exists in input validation for IP address and domain fields, where the application fails to enforce length restrictions on user-supplied strings. When input exceeding the allocated buffer size is provided, it overwrites adjacent memory, causing uncontrolled application termination. The attack vector is local with no privileges required and no user interaction, meaning any account on the system can trigger the crash.

Business impact

Organizations relying on Arm Whois 3.11 as part of their infrastructure reconnaissance or network troubleshooting workflows face intermittent service disruption. While the vulnerability does not enable data exfiltration or privilege escalation, repeated crashes can disrupt operational continuity and frustrate incident response or administrative tasks. For environments where Whois lookups are automated or integrated into larger workflows, denial of service could cascade into dependent systems.

Affected systems

Arm Whois version 3.11 is affected. Users of this specific version should assess their deployment footprint. Verify whether your organization uses Arm Whois in production, test, or development environments, and document which systems or accounts have local access to trigger input fields.

Exploitability

Exploitability is straightforward for local attackers. No special privileges, complex exploitation techniques, or user interaction are required. An attacker with shell or interactive access to the system running Arm Whois can immediately reproduce the crash by pasting a 700-byte payload into the affected input field. The attack is reliable and repeatable, though impact is limited to availability rather than confidentiality or integrity.

Remediation

Upgrade Arm Whois to a version released after the vulnerability was identified. Consult the vendor advisory to confirm the patched version number and any compatibility considerations. As an interim control, restrict local access to systems running Arm Whois 3.11 to trusted users only, and monitor for unexpected process crashes or restarts of the Whois service.

Patch guidance

Contact the Arm Whois vendor or check their official release notes to identify the fixed version. Apply the patch in a controlled manner by testing in a non-production environment first, verifying functionality with your integration workflows, and then rolling out to production systems. Document the patched version in your asset inventory.

Detection guidance

Monitor system logs for repeated crashes or abnormal termination of Arm Whois processes. Implement application-level logging if available to capture oversized input attempts. Network intrusion detection may be ineffective since the attack is local; focus on endpoint and process monitoring. Consider integrity checks on the Whois binary to detect tampering or exploitation artifacts.

Why prioritize this

Although CVSS 6.2 (MEDIUM) reflects the lack of confidentiality and integrity impact, the ease of exploitation and local-access requirement warrant prompt remediation in environments where Whois is operationally critical. Organizations should prioritize this update for internet-facing or DMZ-deployed instances, but overall urgency is moderate since the attack requires pre-existing system access and causes only temporary disruption.

Risk score, explained

The CVSS 3.1 score of 6.2 reflects: Attack Vector Local (no remote exploitation), Access Complexity Low (no special conditions), Privileges Required None (any local user can trigger it), User Interaction None (no clicking or social engineering), and Availability Impact High (crash = complete denial of that service). Confidentiality and Integrity remain unaffected, preventing a higher score. The lack of CISA KEV listing confirms this is not yet weaponized in the wild at scale.

Frequently asked questions