PT-2005-5445 · Netbsd · Netbsd

Nathan J. Williams · Published 2005-12-31 · Updated 2008-09-05 · CVE-2005-4782

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions NetBSD versions 2.0 through 2.0.3 NetBSD versions 2.1 through 2.1.0 NetBSD version 3

Description The issue allows local users to cause a denial of service, resulting in a kernel assertion panic. This can be achieved by setting a negative linger time in the SO LINGER socket option when the kernel is compiled with the "options DIAGNOSTIC" setting.

Recommendations For NetBSD versions 2.0 through 2.0.3, update to version 2.0.4 or later. For NetBSD versions 2.1 through 2.1.0, update to version 2.1.1 or later. For NetBSD version 3, consider disabling the "options DIAGNOSTIC" setting until a patch is available. As a temporary workaround, avoid using negative linger times in the SO LINGER socket option.

Fix

Related Identifiers

CVE-2005-4782

Affected Products

Netbsd

References · 5

• http://mail-index.netbsd.org/source-changes/2005/10/21/0038.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-4782 · Security Note
• http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/kern/uipc_socket.c.diff?r1=1.111&r2=1.112 · Patch
• http://securityfocus.com/bid/15289 · Note
• http://mail-index.netbsd.org/netbsd-announce/2005/11/08/0010.html · Patch, Vendor Advisory