PT-2013-4134 · Freebsd · Freebsd

Publicado 2013-08-28 · Atualizado 2019-03-18 · CVE-2013-3077

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.3 through 9.2-PRERELEASE

Description The issue is related to multiple integer overflows in the IP MSFILTER and IPV6 MSFILTER features within the multicast implementation in the kernel. This affects files sys/netinet/in mcast.c and sys/netinet6/in6 mcast.c, allowing local users to bypass restrictions on kernel-memory read and write operations. As a result, users can gain privileges through vectors involving a large number of source-filter entries.

Recommendations For FreeBSD versions 8.3 through 9.2-PRERELEASE, consider restricting access to the multicast implementation in the kernel until a patch is available. As a temporary workaround, limit the number of source-filter entries to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2013-3077

DSA-2743-1

Produtos afetados

Freebsd

Referências · 3

• http://svnweb.freebsd.org/base?view=revision&revision=254629 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2013-3077 · Nota de Segurança
• http://freebsd.org/security/advisories/FreeBSD-SA-13:09.ip_multicast.asc · Aviso do Fabricante