PT-2005-5442 · Netbsd · Netbsd

Published 2005-12-31 · Updated 2008-09-05 · CVE-2005-4779

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions NetBSD version 2.0.2

Description The issue is related to the verifiedexecioctl in verified exec.c, which calls NDINIT with UIO USERSPACE instead of UID SYSSPACE. This removes the functionality of the verified exec kernel subsystem and might allow local users to execute malicious programs.

Recommendations For NetBSD version 2.0.2, consider applying a patch or fix that corrects the NDINIT call to use UID SYSSPACE instead of UIO USERSPACE to restore the functionality of the verified exec kernel subsystem.

Fix

Related Identifiers

CVE-2005-4779

Affected Products

Netbsd

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-4779 · Security Note
• http://mail-index.netbsd.org/netbsd-announce/2005/10/31/0000.html · Patch
• http://osvdb.org/20725 · Patch
• http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/verified_exec.c.diff?r1=1.4&r2=1.4.2.1&f=h · Note
• http://releng.netbsd.org/cgi-bin/req-2-0.cgi?show=1988 · Note