PT-2003-1236 · Netbsd · Netbsd

Published 2003-03-18 · Updated 2008-09-05 · CVE-2002-1500

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NetBSD versions 1.4.x through 1.6

Description A buffer overflow issue exists in certain programs, including mrinfo, mtrace, and pppd, allowing local users to gain privileges. This occurs when the file descriptor tables are filled, resulting in file descriptors larger than FD SETSIZE, which are not properly checked by the FD SET() function.

Recommendations For NetBSD versions 1.4.x through 1.6, consider restricting access to the mrinfo, mtrace, and pppd programs until a fix is available. As a temporary workaround, avoid executing these programs with elevated privileges to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2002-1500

Affected Products

Netbsd

References · 4

• http://iss.net/security_center/static/10114.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1500 · Security Note
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-014.txt.asc · Vendor Advisory
• http://securityfocus.com/bid/5727 · Vendor Advisory