Null pointer dereference

libprop/propobject.c in proplib in NetBSD 4.0 and 4.0.1 allows local users to cause a denial of service NULL pointer dereference and kernel panic via a malformed externalized plist XML form containing an undefined element...

CVE-2009-2482

The pamunix module in OpenPAM in NetBSD 4.0 before 4.0.2 and 5.0 before 5.0.1 allows local users to change the current root password if it is already known, even when they are not in the wheel group...

CVE-2009-2483

libprop/propobject.c in proplib in NetBSD 4.0 and 4.0.1 allows local users to cause a denial of service NULL pointer dereference and kernel panic via a malformed externalized plist XML form containing an undefined element...

Design/Logic Flaw

The pamunix module in OpenPAM in NetBSD 4.0 before 4.0.2 and 5.0 before 5.0.1 allows local users to change the current root password if it is already known, even when they are not in the wheel group...

CVE-2009-2482

The vulnerability CVE-2009-2482 affects the pam_unix module in OpenPAM used by NetBSD 4.0 up to 4.0.2 and NetBSD 5.0 up to 5.0.1. The underlying issue allows a local user to change the current root password if it is already known, even when the user is not in the wheel group. This is a local-acce...

CVE-2009-2483

The CVE-2009-2483 entry affects NetBSD 4.0 and 4.0.1 via libprop/prop_object.c in proplib. A local attacker can trigger a denial of service by supplying a malformed externalized plist (XML form) containing an undefined element, causing a NULL pointer dereference and kernel panic. The connected do...

CVE-2009-2483

libprop/propobject.c in proplib in NetBSD 4.0 and 4.0.1 allows local users to cause a denial of service NULL pointer dereference and kernel panic via a malformed externalized plist XML form containing an undefined element...

CVE-2009-2482

The pamunix module in OpenPAM in NetBSD 4.0 before 4.0.2 and 5.0 before 5.0.1 allows local users to change the current root password if it is already known, even when they are not in the wheel group...

ISC DHCP dhclient stack buffer overflow

Overview The ISC DHCP dhclient application contains a stack buffer overflow, which may allow a remote, unauthenticated attacker to execute arbitrary code with root privileges. Description As described in RFC 2131, "The Dynamic Host Configuration Protocol DHCP provides a framework for passing...

CVE-2009-0689

Array index error in the 1 dtoa implementation in dtoa.c aka pdtoa.c and the 2 gdtoa aka new dtoa implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x...

Heap overflow

Array index error in the 1 dtoa implementation in dtoa.c aka pdtoa.c and the 2 gdtoa aka new dtoa implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x...

CVE-2009-0689

Array index error in the 1 dtoa implementation in dtoa.c aka pdtoa.c and the 2 gdtoa aka new dtoa implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x...

CVE-2009-0689

Array index error in the 1 dtoa implementation in dtoa.c aka pdtoa.c and the 2 gdtoa aka new dtoa implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x...

多个BSD系统gdtoa/misc.c文件内存破坏漏洞

BUGTRAQ ID: 35510 CVECAN ID: CVE-2009-0689 OpenBSD、NetBSD、FreeBSD都是流行的BSD操作系统，是Unix的衍生系统。 OpenBSD、NetBSD、FreeBSD的dtoa实现中存在数组溢出漏洞。在src/lib/libc/gdtoa/gdtoaimp.h中： - ---gdtoaimp.h--- ... define Kmax 15 ... - ---gdtoaimp.h--- 最大的Kmax长度为15，如果提供了更大的值（如17），程序就会溢出freelist数组，bss为0x1。 以NetBSD为例： -...

[Full-disclosure] SecurityReason: Multiple Vendors libc/gdtoa printf(3) Array Overrun

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Multiple Vendors libc/gdtoa printf3 Array Overrun Author: Maksymilian Arciemowicz http://SecurityReason.com Date: - - Dis.: 07.05.2009 - - Pub.: 25.06.2009 CVE: CVE-2009-0689 Risk: High Affected Software 12.06.2009: - - OpenBSD 4.5 - - NetBSD 5.0 - -...

NetBSD proplib库XML处理拒绝服务漏洞

BUGTRAQ ID: 35466 NetBSD是一款免费开放源代码的UNIX性质的操作系统。 NetBSD的proplib库在处理外部XML表单中的未定义元素（如number）时可能触发空指针引用。所有使用proplib库进行内核通讯的驱动都受这个漏洞影响，因此能够访问驱动的普通用户就可以导致系统崩溃。 NetBSD 4.0.1 NetBSD 4.0 厂商补丁： NetBSD ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.netbsd.org/Security/...

NetBSD pam_unix模块非授权更改root口令漏洞

BUGTRAQ ID: 35465 NetBSD是一款免费开放源代码的UNIX性质的操作系统。 NetBSD所提供的pamunix认证模块没有正确地验证执行口令更改的用户，通过认证的非特权用户如果知道了旧的root口令就可以更改该口令。通常认证为root仅限于被称为wheel组的成员，以限制泄露root口令所造成的影响。因此，能够更改root口令应仅限于认证为root的用户。 NetBSD 5.0 NetBSD 4.0.1 NetBSD 4.0 临时解决方法： 在/etc/pam.d/system的pamunix之前添加以下行： password prerequisite...

netbsd/x86 kill all processes shellcode 23 bytes

No description provided by source. / netbsd/x86 kill all processes shellcode this shellcode is using syscall number 37 or 0x25 37 STD int syskillint pid, int signum; here is assembler code using intel syntaxe and NASM --------------begin----------- section .note.netbsd.ident dd 0x07,0x04,0x01 db...

NetBSD x86 Kill All Processes Shellcode

/ netbsd/x86 kill all processes shellcode author REMOVED AT REQUEST OF AUTHOR contact REMOVED AT REQUEST OF AUTHOR this shellcode is using syscall number 37 or 0x25 37 STD int syskillint pid, int signum; here is assembler code using intel syntaxe and NASM --------------begin----------- section...

netbsd/x86 kill all processes shellcode 23 bytes

netbsd/x86 kill all processes shellcode 23 bytes. Shellcode exploit for netbsdx86 platform / netbsd/x86 kill all processes shellcode author Anonymous this shellcode is using syscall number 37 or 0x25 37 STD int syskillint pid, int signum; here is assembler code using intel syntaxe and NASM...