PT-2017-1212 · Netbsd · Netbsd

Akat1 · Published 2017-01-20 · Updated 2017-01-20 · CVE-2016-6253

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NetBSD versions 6.0 through 6.0.6 NetBSD versions 6.1 through 6.1.5 NetBSD versions 7.0

Description The issue is related to an incorrect link resolution before file access in the mail.local service of the NetBSD operating system. This can be exploited by a local attacker to bypass protection and manipulate symbolic links, potentially allowing them to change ownership of or append data to arbitrary files on the target system via a symlink attack on the user mailbox.

Recommendations For NetBSD versions 6.0 through 6.0.6, consider restricting access to the mail.local service until a patch is available. For NetBSD versions 6.1 through 6.1.5, avoid using the mail.local service for sensitive operations until the issue is resolved. For NetBSD versions 7.0, as a temporary workaround, consider disabling the mail.local service to minimize the risk of exploitation.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2017-00325

CVE-2016-6253

Affected Products

Netbsd

References · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/local/netbsd_mail_local.rb · Exploit
• 🔥 https://exploit-db.com/exploits/40385 · Exploit
• 🔥 http://packetstormsecurity.com/files/138021/NetBSD-mail.local-8-Local-Root.html · Exploit
• 🔥 https://exploit-db.com/exploits/40141 · Exploit
• 🔥 http://rapid7.com/db/modules/exploit/unix/local/netbsd_mail_local · Exploit
• 🔥 http://akat1.pl/?id=2 · Exploit
• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-006.txt.asc · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00325 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6253 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6253 · Security Note
• http://securitytracker.com/id/1036429 · Note
• http://securityfocus.com/bid/92101 · Note