PT-2005-5442 · Netbsd · Netbsd

Publicado 2005-12-31 · Atualizado 2008-09-05 · CVE-2005-4779

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions NetBSD version 2.0.2

Description The issue is related to the verifiedexecioctl in verified exec.c, which calls NDINIT with UIO USERSPACE instead of UID SYSSPACE. This removes the functionality of the verified exec kernel subsystem and might allow local users to execute malicious programs.

Recommendations For NetBSD version 2.0.2, consider applying a patch or fix that corrects the NDINIT call to use UID SYSSPACE instead of UIO USERSPACE to restore the functionality of the verified exec kernel subsystem.

Correção

Identificadores relacionados

CVE-2005-4779

Produtos afetados

Netbsd

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-4779 · Nota de Segurança
• http://mail-index.netbsd.org/netbsd-announce/2005/10/31/0000.html · Correção
• http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/verified_exec.c.diff?r1=1.4&r2=1.4.2.1&f=h · Nota
• http://releng.netbsd.org/cgi-bin/req-2-0.cgi?show=1988 · Nota
• http://osvdb.org/20725 · Correção