PT-2006-6498 · Freebsd · Freebsd

Published 2006-11-09 · Updated 2017-07-20 · CVE-2006-5824

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: FreeBSD version 6.1

Description: The issue is related to an integer overflow in the ffs rdextattr function, which can be triggered by a local user via a crafted UFS filesystem. This can cause a denial of service, resulting in a kernel panic, and potentially trigger a heap-based buffer overflow. It is noted that only root may mount a filesystem, which may limit the impact of this issue.

Recommendations: For FreeBSD version 6.1, consider restricting access to mounting filesystems to minimize the risk of exploitation, as only root users can mount a filesystem, which may limit the impact of this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-5824

Affected Products

Freebsd

References · 4

• http://projects.info-pull.com/mokb/MOKB-08-11-2006.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5824 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30144 · Note
• http://lists.freebsd.org/pipermail/freebsd-security/2007-January/004218.html · Note