PT-2007-3047 · Netbsd · Netbsd

Publicado 2007-03-30 · Atualizado 2017-07-29 · CVE-2007-1677

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Média

Vetor base

AV:L/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: NetBSD versions 2.0 through 4.0 BETA2 NetBSD-current before 20070329

Description: The issue concerns buffer overflows in the ISO network protocol support within the NetBSD kernel. This can be exploited by local users to execute arbitrary code by passing long parameters to certain functions. For example, a long sockaddr structure argument can be passed to the clnp route function to achieve this.

Recommendations: For NetBSD versions 2.0 through 4.0 BETA2, update to a version after 4.0 BETA2 to resolve the issue. For NetBSD-current before 20070329, update to a version after 20070329 to resolve the issue. As a temporary workaround, consider restricting access to the clnp route function until a patch is available.

Correção

Identificadores relacionados

CVE-2007-1677

Produtos afetados

Netbsd

Referências · 7

• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-004.txt.asc · Aviso do Fabricante
• http://securityfocus.com/bid/23193 · Nota
• http://osvdb.org/43596 · Nota
• http://securitytracker.com/id?1017832 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33381 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1677 · Nota de Segurança
• http://vupen.com/english/advisories/2007/1159 · Nota