PT-2017-8974 · Openbsd · Openbsd

Jesse Hertz · Publicado 2017-03-07 · Atualizado 2017-03-09 · CVE-2016-6350

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenBSD versions 5.8 through 5.9

Description The issue allows local users to cause a denial of service, resulting in a NULL pointer dereference and panic. This can be achieved via a sysctl call with a path starting with 10,9.

Recommendations For OpenBSD versions 5.8 and 5.9, consider restricting access to sysctl calls to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2016-6350

Produtos afetados

Openbsd

Referências · 7

• 🔥 http://openwall.com/lists/oss-security/2016/07/26/6 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2016/07/26/8 · Exploit
• https://osv.dev/vulnerability/CVE-2016-6350 · Aviso do Fabricante
• http://securityfocus.com/bid/92140 · Nota
• http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/kern/vfs_subr.c.diff?r1=1.248&r2=1.249 · Correção
• http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/tmpfs/tmpfs_vfsops.c.diff?r1=1.9&r2=1.10 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-6350 · Nota de Segurança