PT-2007-3047 · Netbsd · Netbsd

Published 2007-03-30 · Updated 2017-07-29 · CVE-2007-1677

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: NetBSD versions 2.0 through 4.0 BETA2 NetBSD-current before 20070329

Description: The issue concerns buffer overflows in the ISO network protocol support within the NetBSD kernel. This can be exploited by local users to execute arbitrary code by passing long parameters to certain functions. For example, a long sockaddr structure argument can be passed to the clnp route function to achieve this.

Recommendations: For NetBSD versions 2.0 through 4.0 BETA2, update to a version after 4.0 BETA2 to resolve the issue. For NetBSD-current before 20070329, update to a version after 20070329 to resolve the issue. As a temporary workaround, consider restricting access to the clnp route function until a patch is available.

Fix

Related Identifiers

CVE-2007-1677

Affected Products

Netbsd

References · 7

• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-004.txt.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1677 · Security Note
• http://securityfocus.com/bid/23193 · Note
• http://osvdb.org/43596 · Note
• http://securitytracker.com/id?1017832 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33381 · Note
• http://vupen.com/english/advisories/2007/1159 · Note