PT-2003-1236 · Netbsd · Netbsd

Publicado 2003-03-18 · Atualizado 2008-09-05 · CVE-2002-1500

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NetBSD versions 1.4.x through 1.6

Description A buffer overflow issue exists in certain programs, including mrinfo, mtrace, and pppd, allowing local users to gain privileges. This occurs when the file descriptor tables are filled, resulting in file descriptors larger than FD SETSIZE, which are not properly checked by the FD SET() function.

Recommendations For NetBSD versions 1.4.x through 1.6, consider restricting access to the mrinfo, mtrace, and pppd programs until a fix is available. As a temporary workaround, avoid executing these programs with elevated privileges to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2002-1500

Produtos afetados

Netbsd

Referências · 4

• http://iss.net/security_center/static/10114.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-1500 · Nota de Segurança
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-014.txt.asc · Aviso do Fabricante
• http://securityfocus.com/bid/5727 · Aviso do Fabricante