PT-2016-2095 · Freebsd · Freebsd

Cturt · Published 2016-05-17 · Updated 2016-05-26 · CVE-2016-1887

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeBSD versions 10.1 through 10.1 p33 FreeBSD versions 10.2 through 10.2 p16 FreeBSD versions 10.3 through 10.3 p2

Description The issue is caused by an integer signedness error in the sockargs function, which can lead to a heap-based buffer overflow. This can allow local users to cause a denial of service, such as a memory overwrite and kernel panic, or potentially gain privileges. The vulnerability is triggered by a negative buflen argument.

Recommendations For FreeBSD version 10.1, update to version 10.1 p34 or later. For FreeBSD version 10.2, update to version 10.2 p17 or later. For FreeBSD version 10.3, update to version 10.3 p3 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2016-01447

CVE-2016-1887

FREEBSD-SA-16_19

Affected Products

Freebsd

References · 7

• 🔥 http://cturt.github.io/sendmsg.html · Exploit
• 🔥 https://exploit-db.com/exploits/44212 · Exploit
• https://bdu.fstec.ru/vul/2016-01447 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-16:19.sendmsg.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1887 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1887 · Vendor Advisory
• http://securitytracker.com/id/1035906 · Note