PT-2013-5727 · Freebsd · Freebsd

Published 2013-09-23 · Updated 2013-10-24 · CVE-2013-5691

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.3 through 9.2-STABLE

Description The issue concerns the lack of validation in the IPv6 and ATM ioctl request handlers within the kernel. This allows local users to perform certain link-layer actions, cause a denial of service, or possibly gain privileges by using a crafted application. The handlers do not properly validate SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR, and SIOCSIFNETMASK requests.

Recommendations For FreeBSD versions 8.3 through 9.2-STABLE, consider updating to a version that includes the necessary patches to validate ioctl requests. As a temporary workaround, restrict local user privileges to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-5691

DSA-2769-1

Affected Products

Freebsd

References · 5

• http://debian.org/security/2013/dsa-2769 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5691 · Security Note
• http://freebsd.org/security/advisories/FreeBSD-SA-13:12.ifioctl.asc · Vendor Advisory
• http://svnweb.freebsd.org/base?view=revision&revision=255442 · Patch
• http://secunia.com/advisories/54861 · Note