PT-2010-2318 · Netbsd · Netbsd

Pierre Pronchery · Published 2010-02-08 · Updated 2010-02-09 · CVE-2010-0561

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions NetBSD versions 4.0 through 5.0 NetBSD-current before 2010-01-21

Description The issue allows local users to cause a denial of service, resulting in a kernel panic. This is achieved by passing a negative mixer index number to either the azalia query devinfo function in the azalia audio driver or the hdaudio afg query devinfo function in the hdaudio audio driver.

Recommendations For NetBSD versions 4.0 through 5.0, consider updating to a version released after 2010-01-21 to resolve the issue. For NetBSD-current before 2010-01-21, update to a version released after 2010-01-21 to resolve the issue. As a temporary workaround, consider restricting access to the azalia query devinfo function and the hdaudio afg query devinfo function to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2010-0561

Affected Products

Netbsd

References · 7

• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2010-003.txt.asc · Vendor Advisory
• http://secunia.com/advisories/38284 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0561 · Security Note
• http://securityfocus.com/bid/38057 · Note
• http://osvdb.org/62082 · Note
• http://securitytracker.com/id?1023539 · Note
• http://osvdb.org/62081 · Note