PT-2006-6660 · Trustedbsd+4 · Trustedbsd+4

Rodrigo Rubira Branco · Published 2006-11-21 · Updated 2018-10-17 · CVE-2006-6013

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions DragonFlyBSD (affected versions not specified) FreeBSD version 5.5 MidnightBSD versions prior to 0.1-CURRENT 20061115 NetBSD versions prior to 4.0 20061203 NetBSD-current versions prior to 20061116 TrustedBSD (affected versions not specified)

Description The issue is caused by an integer signedness error in the fw ioctl function, specifically when handling certain negative values of crom buf->len in an FW GCROM command. This allows local users to read arbitrary memory contents.

Recommendations For DragonFlyBSD, at the moment, there is no information about a newer version that contains a fix for this issue. For FreeBSD version 5.5, at the moment, there is no information about a newer version that contains a fix for this issue. For MidnightBSD versions prior to 0.1-CURRENT 20061115, at the moment, there is no information about a newer version that contains a fix for this issue. For NetBSD versions prior to 4.0 20061203, at the moment, there is no information about a newer version that contains a fix for this issue. For NetBSD-current versions prior to 20061116, at the moment, there is no information about a newer version that contains a fix for this issue. For TrustedBSD, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2006-6013

Affected Products

Dragonflybsd

Freebsd

Midnightbsd

Netbsd

Trustedbsd

References · 20

• http://kernelhacking.com/bsdadv1.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6013 · Security Note
• http://secunia.com/advisories/22917 · Vendor Advisory
• http://security.freebsd.org/advisories/FreeBSD-SA-06:25.kmem.asc · Vendor Advisory
• http://dragonflybsd.org/cvsweb/src/sys/bus/firewire/fwdev.c · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0261.html · Note
• http://securityfocus.com/archive/1/451698/100/0/threaded · Note
• http://securityfocus.com/archive/1/452124/100/0/threaded · Note
• http://securityfocus.com/archive/1/451629/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30347 · Note
• http://securityfocus.com/archive/1/451677/100/0/threaded · Note
• http://securityfocus.com/bid/21089 · Note
• http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/ieee1394/fwdev.c · Note
• http://securityfocus.com/archive/1/452331/100/0/threaded · Note
• http://securityfocus.com/archive/1/451637/100/0/threaded · Note