PT-2003-2234 · Netbsd+1 · Netbsd+1

Publicado 2003-12-31 · Atualizado 2017-07-20 · CVE-2003-1289

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions NetBSD versions 1.5 through 1.5.3 FreeBSD versions 4 up to 4.8-RELEASE-p2 FreeBSD versions 5 up to 5.1-RELEASE-p1

Description The issue allows local users to read portions of kernel memory via a large length parameter in the statfs system call translator. This occurs because the large length parameter copies additional kernel memory into userland memory, resulting in memory disclosure.

Recommendations For NetBSD versions 1.5 through 1.5.3, consider restricting access to the statfs system call until a patch is available. For FreeBSD versions 4 up to 4.8-RELEASE-p2, restrict the use of the statfs system call translator to minimize the risk of exploitation. For FreeBSD versions 5 up to 5.1-RELEASE-p1, avoid using large length parameters in the statfs system call translator until the issue is resolved.

Correção

Identificadores relacionados

CVE-2003-1289

Produtos afetados

Freebsd

Netbsd

Referências · 6

• http://osvdb.org/2406 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2003-1289 · Nota de Segurança
• http://secunia.com/advisories/9504 · Aviso do Fabricante
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:10.ibcs2.asc · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/12892 · Nota
• http://securitytracker.com/id?1007460 · Aviso do Fabricante