PT-2013-5727 · Freebsd · Freebsd

Publicado 2013-09-23 · Atualizado 2013-10-24 · CVE-2013-5691

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.3 through 9.2-STABLE

Description The issue concerns the lack of validation in the IPv6 and ATM ioctl request handlers within the kernel. This allows local users to perform certain link-layer actions, cause a denial of service, or possibly gain privileges by using a crafted application. The handlers do not properly validate SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR, and SIOCSIFNETMASK requests.

Recommendations For FreeBSD versions 8.3 through 9.2-STABLE, consider updating to a version that includes the necessary patches to validate ioctl requests. As a temporary workaround, restrict local user privileges to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-5691

DSA-2769-1

Produtos afetados

Freebsd

Referências · 5

• http://debian.org/security/2013/dsa-2769 · Aviso do Fabricante
• http://secunia.com/advisories/54861 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5691 · Nota de Segurança
• http://freebsd.org/security/advisories/FreeBSD-SA-13:12.ifioctl.asc · Aviso do Fabricante
• http://svnweb.freebsd.org/base?view=revision&revision=255442 · Correção