PT-2001-1497 · Openbsd+1 · Openbsd+1

Published 2001-05-03 · Updated 2017-10-10 · CVE-2001-0268

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NetBSD versions 1.5 and earlier OpenBSD versions 2.8 and earlier

Description The issue concerns the i386 set ldt system call, which, when the USER LDT kernel option is enabled, fails to validate a call gate target. This allows local users to gain root privileges by creating a segment call gate in the Local Descriptor Table (LDT) with a target that specifies an arbitrary kernel address.

Recommendations For NetBSD versions 1.5 and earlier, consider disabling the USER LDT kernel option as a temporary workaround until a patch is available. For OpenBSD versions 2.8 and earlier, consider disabling the USER LDT kernel option as a temporary workaround until a patch is available.

Fix

Related Identifiers

CVE-2001-0268

Affected Products

Netbsd

Openbsd

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2001-0268 · Security Note
• http://openbsd.org/errata.html#userldt · Vendor Advisory
• http://archives.neohapsis.com/archives/linux/caldera/2001-q4/0014.html · Vendor Advisory
• http://archives.neohapsis.com/archives/netbsd/2001-q1/0093.html · Vendor Advisory
• http://kb.cert.org/vuls/id/358960 · Note
• http://securityfocus.com/bid/2739 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6222 · Note
• http://osvdb.org/6141 · Note
• http://archives.neohapsis.com/archives/bugtraq/2001-02/0353.html · Note