FreeBSD : gnupg -- attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output (e1c71d8d-64d9-11e6-b38a-25a46b33f2ed)

Werner Koch reports : There was a bug in the mixing functions of Libgcrypt's random number generator: An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. This bug exists since 1998 in all GnuPG and Libgcrypt versions. %NASLMINLEVEL 70300 C Tenable...

Hydra 8.3 - Network Logon Cracker

A very fast network logon cracker which support many different services. See feature sets and services coverage page - incl. a speed comparison against ncrack and medusa.Number one of the biggest security holes are passwords, as every password security study shows. This tool is a proof of concept...

FreeBSD : puppet-agent MCollective plugin -- Remote Code Execution vulnerability (df502a2f-61f6-11e6-a461-643150d3111d)

Puppet reports : Puppet Enterprise previously included a puppet-agent MCollective plugin that allowed you to pass the --server argument to MCollective. This insecure argument enabled remote code execution via connection to an untrusted host. The puppet-agent MCollective version included in PE...

FreeBSD : TeamSpeak Server 3 -- Multiple vulnerabilities including Remote Code Execution (f7dd2d09-625e-11e6-828b-fcaa14edc6a6)

Hanz Jenson audit report : I found 10 vulnerabilities. Some of these are critical and allow remote code execution. For the average user, that means that these vulnerabilities can be exploited by a malicious attacker in order to take over any Teamspeak server, not only becoming serveradmin, but...

FreeBSD : FreeBSD -- Linux compatibility layer setgroups(2) system call (798f63e0-600a-11e6-a6c3-14dae9d210b8)

A programming error in the Linux compatibility layer setgroups2 system call can lead to an unexpected results, such as overwriting random kernel memory contents. Impact : It is possible for a local attacker to overwrite portions of kernel memory, which may result in a privilege escalation or caus...

FreeBSD : FreeBSD -- TCP MD5 signature denial of service (79dfc135-600a-11e6-a6c3-14dae9d210b8)

A programming error in processing a TCP connection with both TCPMD5SIG and TCPNOOPT socket options may lead to kernel crash. Impact : A local attacker can crash the kernel, resulting in a denial-of-service. A remote attack is theoretically possible, if server has a listening socket with TCPNOOPT...

FreeBSD : FreeBSD -- Linux compatibility layer incorrect futex handling (793fb19c-600a-11e6-a6c3-14dae9d210b8)

A programming error in the handling of Linux futex robust lists may result in incorrect memory locations being accessed. Impact : It is possible for a local attacker to read portions of kernel memory, which may result in a privilege escalation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

FreeBSD : FreeBSD -- Kernel stack disclosure in 4.3BSD compatibility layer (7cad4795-600a-11e6-a6c3-14dae9d210b8)

The implementation of historic stat2 system call does not clear the output struct before copying it out to userland. Impact : An unprivileged user can read a portion of uninitialised kernel stack data, which may contain sensitive information, such as the stack guard, portions of the file cache or...

FreeBSD : FreeBSD -- TCP reassembly vulnerability (6d472244-6007-11e6-a6c3-14dae9d210b8)

FreeBSD may add a reassemble queue entry on the stack into the segment list when the reassembly queue reaches its limit. The memory from the stack is undefined after the function returns. Subsequent iterations of the reassembly function will attempt to access this entry. Impact : An attacker who...

FreeBSD : FreeBSD -- rpcbind(8) remote denial of service [REVISED] (0e5d6969-600a-11e6-a6c3-14dae9d210b8)

In rpcbind8, netbuf structures are copied directly, which would result in two netbuf structures that reference to one shared address buffer. When one of the two netbuf structures is freed, access to the other netbuf structure would result in an undefined result that may crash the rpcbind8 daemon...

FreeBSD : FreeBSD -- ktrace kernel memory disclosure (6e04048b-6007-11e6-a6c3-14dae9d210b8)

Due to an overlooked merge to -STABLE branches, the size for page fault kernel trace entries was set incorrectly. Impact : A user who can enable kernel process tracing could end up reading the contents of kernel memory. Such memory might contain sensitive information, such as portions of the file...

FreeBSD : FreeBSD -- Insecure default GELI keyfile permissions (0b65f297-600a-11e6-a6c3-14dae9d210b8)

The default permission set by bsdinstall8 installer when configuring full disk encrypted ZFS is too open. Impact : A local attacker may be able to get a copy of the geli8 provider's keyfile which is located at a fixed location. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

FreeBSD : FreeBSD -- SCTP SCTP_SS_VALUE kernel memory corruption and disclosure (0a5cf6d8-600a-11e6-a6c3-14dae9d210b8)

Due to insufficient validation of the SCTP stream ID, which serves as an array index, a local unprivileged attacker can read or write 16-bits of kernel memory. Impact : An unprivileged process can read or modify 16-bits of memory which belongs to the kernel. This may lead to exposure of sensitive...

FreeBSD : FreeBSD -- Remote command execution in ftp(1) (7488378d-6007-11e6-a6c3-14dae9d210b8)

A malicious HTTP server could cause ftp1 to execute arbitrary commands. Impact : When operating on HTTP URIs, the ftp1 client follows HTTP redirects, and uses the part of the path after the last '/' from the last resource it accesses as the output filename if '-o' is not specified. If the output...

FreeBSD : FreeBSD -- Multiple vulnerabilities in file(1) and libmagic(3) (70140f20-6007-11e6-a6c3-14dae9d210b8)

A specifically crafted Composite Document File CDF file can trigger an out-of-bounds read or an invalid pointer dereference. CVE-2012-1571 A flaw in regular expression in the awk script detector makes use of multiple wildcards with unlimited repetitions. CVE-2013-7345 A malicious input file could...

FreeBSD : FreeBSD -- Multiple integer overflows in expat (libbsdxml) XML parser (0da8a68e-600a-11e6-a6c3-14dae9d210b8)

Multiple integer overflows have been discovered in the XMLGetBuffer function in the expat library. Impact : The integer overflows may be exploited by using specifically crafted XML data and lead to infinite loop, or a heap buffer overflow, which results in a Denial of Service condition, or enable...

FreeBSD : FreeBSD -- sendmail improper close-on-exec flag handling (6d9eadaf-6007-11e6-a6c3-14dae9d210b8)

There is a programming error in sendmail8 that prevented open file descriptors have close-on-exec properly set. Consequently a subprocess will be able to access all open files that the parent process have open. Impact : A local user who can execute their own program for mail delivery will be able...

FreeBSD : FreeBSD -- Buffer overflow in stdio (74ded00e-6007-11e6-a6c3-14dae9d210b8)

A programming error in the standard I/O library's sflush function could erroneously adjust the buffered stream's internal state even when no write actually occurred in the case when write2 system call returns an error. Impact : The accounting mismatch would accumulate, if the caller does not chec...

FreeBSD : FreeBSD -- routed(8) remote denial of service vulnerability (0d584493-600a-11e6-a6c3-14dae9d210b8)

The input path in routed8 will accept queries from any source and attempt to answer them. However, the output path assumes that the destination address for the response is on a directly connected network. Impact : Upon receipt of a query from a source which is not on a directly connected network,...

FreeBSD : FreeBSD -- Local privilege escalation in IRET handler (0dfa5dde-600a-11e6-a6c3-14dae9d210b8)

If the kernel-mode IRET instruction generates an SS or NP exception, but the exception handler does not properly ensure that the right GS register base for kernel is reloaded, the userland GS segment may be used in the context of the kernel exception handler. Impact : By causing an IRET with SS o...