PT-2011-3208 · Netbsd · Netbsd

Tavis Ormandy · Published 2011-05-09 · Updated 2011-09-07 · CVE-2011-1547

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NetBSD versions 4.0, 5.0 through 5.0.2, and 5.1 through 5.1.0

Description The issue is related to multiple stack consumption vulnerabilities in the kernel when IPsec is enabled. This can be exploited by remote attackers via crafted IPv4 or IPv6 packets with nested IPComp headers, potentially leading to a denial of service, memory corruption, and panic, or possibly having other unspecified impacts.

Recommendations For NetBSD version 4.0, update to a newer version to mitigate the risk. For NetBSD versions 5.0 through 5.0.2, update to version 5.0.3 or later. For NetBSD versions 5.1 through 5.1.0, update to version 5.1.1 or later.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-1547

Affected Products

Netbsd

References · 5

• 🔥 https://exploit-db.com/exploits/17097 · Exploit
• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2011-004.txt.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1547 · Security Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2011-April/080031.html · Note
• http://kb.cert.org/vuls/id/668220 · Note