FreeBSD : FreeBSD -- Multiple ntp vulnerabilities (7cfcea05-600a-11e6-a6c3-14dae9d210b8)

Multiple vulnerabilities have been discovered in the NTP suite : The fix for Sec 3007 in ntp-4.2.8p7 contained a bug that could cause ntpd to crash. CVE-2016-4957, Reported by Nicolas Edet of Cisco An attacker who knows the origin timestamp and can send a spoofed packet containing a CRYPTO-NAK to...

FreeBSD : FreeBSD -- Incorrect argument validation in sysarch(2) (7b6a11b5-600a-11e6-a6c3-14dae9d210b8)

A special combination of sysarch2 arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to lack of sufficient bounds checking during argument validity verification, unbound zero'ing of the proce...

FreeBSD : FreeBSD -- Incorrect error handling in PAM policy parser (6e8f9003-6007-11e6-a6c3-14dae9d210b8)

The OpenPAM library searches for policy definitions in several locations. While doing so, the absence of a policy file is a soft failure handled by searching in the next location while the presence of an invalid file is a hard failure handled by returning an error to the caller. The policy parser...

FreeBSD : FreeBSD -- Incorrect argument handling in sendmsg(2) (7c0bac69-600a-11e6-a6c3-14dae9d210b8)

Incorrect argument handling in the socket code allows malicious local user to overwrite large portion of the kernel memory. Impact : Malicious local user may crash kernel or execute arbitrary code in the kernel, potentially gaining superuser privileges. %NASLMINLEVEL 70300 C Tenable Network...

FreeBSD : FreeBSD -- memory leak in sandboxed namei lookup (73964eac-6007-11e6-a6c3-14dae9d210b8)

The namei facility will leak a small amount of kernel memory every time a sandboxed process looks up a nonexistent path name. Impact : A remote attacker that can cause a sandboxed process for instance, a web server to look up a large number of nonexistent path names can cause memory exhaustion...

FreeBSD : FreeBSD -- Denial of service attack against sshd(8) (73e9a137-6007-11e6-a6c3-14dae9d210b8)

Although OpenSSH is not multithreaded, when OpenSSH is compiled with Kerberos support, the Heimdal libraries bring in the POSIX thread library as a dependency. Due to incorrect library ordering while linking sshd8, symbols in the C library which are shadowed by the POSIX thread library may not be...

FreeBSD : FreeBSD -- Buffer overflow in keyboard driver (7bbc0e8c-600a-11e6-a6c3-14dae9d210b8)

Incorrect signedness comparison in the ioctl2 handler allows a malicious local user to overwrite a portion of the kernel memory. Impact : A local user may crash the kernel, read a portion of kernel memory and execute arbitrary code in kernel context. The result of executing an arbitrary kernel co...

FreeBSD : FreeBSD -- shell injection vulnerability in patch(1) (0c6759dd-600a-11e6-a6c3-14dae9d210b8)

Due to insufficient sanitization of the input patch stream, it is possible for a patch file to cause patch1 to run commands in addition to the desired SCCS or RCS commands. Impact : This issue could be exploited to execute arbitrary commands as the user invoking patch1 against a specially crafted...

FreeBSD : FreeBSD -- Deadlock in the NFS server (6a384960-6007-11e6-a6c3-14dae9d210b8)

The kernel holds a lock over the source directory vnode while trying to convert the target directory file handle to a vnode, which needs to be returned with the lock held, too. This order may be in violation of normal lock order, which in conjunction with other threads that grab locks in the righ...

FreeBSD : FreeBSD -- bsnmpd remote denial of service vulnerability (4c96ecf2-5fd9-11e6-a6c3-14dae9d210b8)

Problem Description : The bsnmpd8 daemon is prone to a stack-based buffer-overflow when it has received a specifically crafted GETBULK PDU request. Impact : This issue could be exploited to execute arbitrary code in the context of the service daemon, or crash the service daemon, causing a...

FreeBSD : FreeBSD -- Kernel stack disclosure in setlogin(2) / getlogin(2) (74389f22-6007-11e6-a6c3-14dae9d210b8)

When setlogin2 is called while setting up a new login session, the login name is copied into an uninitialized stack buffer, which is then copied into a buffer of the same size in the session structure. The getlogin2 system call returns the entire buffer rather than just the portion occupied by th...

FreeBSD : FreeBSD -- Resource exhaustion due to sessions stuck in LAST_ACK state (0c064c43-600a-11e6-a6c3-14dae9d210b8)

TCP connections transitioning to the LASTACK state can become permanently stuck due to mishandling of protocol state in certain situations, which in turn can lead to accumulated consumption and eventual exhaustion of system resources, such as mbufs and sockets. Impact : An attacker who can...

FreeBSD : FreeBSD -- rtsold(8) remote buffer overflow vulnerability (72ee7111-6007-11e6-a6c3-14dae9d210b8)

Due to a missing length check in the code that handles DNS parameters, a malformed router advertisement message can result in a stack buffer overflow in rtsold8. Impact : Receipt of a router advertisement message with a malformed DNSSL option, for instance from a compromised host on the same...

FreeBSD : FreeBSD -- shell injection vulnerability in patch(1) (0d090952-600a-11e6-a6c3-14dae9d210b8)

Due to insufficient sanitization of the input patch stream, it is possible for a patch file to cause patch1 to pass certain ed1 scripts to the ed1 editor, which would run commands. Impact : This issue could be exploited to execute arbitrary commands as the user invoking patch1 against a specially...

FreeBSD : FreeBSD -- Insecure default snmpd.config permissions (7a31dfba-600a-11e6-a6c3-14dae9d210b8)

The SNMP protocol supports an authentication model called USM, which relies on a shared secret. The default permission of the snmpd configuration file, /etc/snmpd.config, is weak and does not provide adequate protection against local unprivileged users. Impact : A local user may be able to read t...

FreeBSD : FreeBSD -- iconv(3) NULL pointer dereference and out-of-bounds array access (6f91a709-6007-11e6-a6c3-14dae9d210b8)

A NULL pointer dereference in the initialization code of the HZ module and an out of bounds array access in the initialization code of the VIQR module make iconvopen3 calls involving HZ or VIQR result in an application crash. Impact : Services where an attacker can control the arguments of an...

FreeBSD : FreeBSD -- Integer overflow in IGMP protocol (0afe8b29-600a-11e6-a6c3-14dae9d210b8)

An integer overflow in computing the size of IGMPv3 data buffer can result in a buffer which is too small for the requested operation. Impact : An attacker who can send specifically crafted IGMP packets could cause a denial of service situation by causing the kernel to crash. %NASLMINLEVEL 70300 ...

FreeBSD : FreeBSD -- Kernel memory disclosure in control messages and SCTP (7240de58-6007-11e6-a6c3-14dae9d210b8)

Buffer between control message header and data may not be completely initialized before being copied to userland. CVE-2014-3952 Three SCTP cmsgs, SCTPSNDRCV, SCTPEXTRCV and SCTPRCVINFO, have implicit padding that may not be completely initialized before being copied to userland. In addition, thre...

FreeBSD : FreeBSD -- Linux compatibility layer issetugid(2) system call (7ac28df1-600a-11e6-a6c3-14dae9d210b8)

A programming error in the Linux compatibility layer could cause the issetugid2 system call to return incorrect information. Impact : If an application relies on output of the issetugid2 system call and that information is incorrect, this could lead to a privilege escalation. %NASLMINLEVEL 70300 ...

FreeBSD : FreeBSD -- Kernel stack disclosure in Linux compatibility layer (7c5d64dd-600a-11e6-a6c3-14dae9d210b8)

The implementation of the TIOCGSERIAL ioctl2 does not clear the output struct before copying it out to userland. The implementation of the Linux sysinfo system call does not clear the output struct before copying it out to userland. Impact : An unprivileged user can read a portion of uninitialise...