openbsd-select-bug.txt

Hi there, Recently a bug in the select syscall of openbsd was published. This text describes the details and the eventual exploitation of this bug. First of all let us look at the definition of select: int selectint nfds, fdset readfds, fdset writefds, fdset exceptfds, struct timeval timeout; The...

/usr/libexec/vi.recover script contains vulnerability allowing arbitrary zero-length files to be removed

Overview The /usr/libexec/vi.recover script in OpenBSD has a vulnerability that could allow an attacker to remove arbitrary zero-length files, including device nodes. Description The /usr/libexec/vi.recover script in OpenBSD cleans up vi temp files and informs a user via email if a recovery file...

OpenBSD contains buffer overflow in "select" call

Overview A locally exploitable buffer overflow exists in all versions of OpenBSD. Description The buffer overflow exists in the select2 system call. The overflow occurs if select is supplied with arbitrary negative values. --- Impact Local users can gain system privileges and execute code in the...

Signed/unsigned conversion bug in OpenBSD select() call

By passing negative argument to select function it's possible to overwrite the fragment of kernel memory...

OpenBSD Security Advisory: Select Boundary Condition

OpenBSD Security Advisory adv.select Original Release Date: 2002-08-11 1. Systems affected: All versions of OpenBSD. 2. Overview: Insufficient boundary checks in the select call allow an attacker to overwrite kernel memory and execute arbitrary code in kernel context. Traditionally, the size...

CVE-2002-0514

PF in OpenBSD 3.0 with the return-rst rule sets the TTL to 128 in the RST packet, which allows remote attackers to determine if a port is being filtered because the TTL is different than the default TTL...

CVE-2002-0766

OpenBSD 2.9 through 3.1 allows local users to cause a denial of service resource exhaustion and gain root privileges by filling the kernel's file descriptor table and closing file descriptors 0, 1, or 2 before executing a privileged process, which is not properly handled when OpenBSD fails to ope...

FreeBSD 4.x NetBSD 1.4.x1.5.x1.6 OpenBSD 3 - pppd Arbitrary File Permission Modification Race Condition

FreeBSD 4.x NetBSD 1.4.x1.5.x1.6 OpenBSD 3 - pppd Arbitrary File Permission Modification Race Condition source: https://www.securityfocus.com/bid/5355/info A vulnerability has been reported in some versions of the pppd daemon included with multiple BSD distributions. A race condition error in the...

FreeBSD 4.x / NetBSD 1.4.x/1.5.x/1.6 / OpenBSD 3 - pppd Arbitrary File Permission Modification Race Condition

source: https://www.securityfocus.com/bid/5355/info A vulnerability has been reported in some versions of the pppd daemon included with multiple BSD distributions. A race condition error in the code may result in the pppd process changing the file permissions on an arbitrary system file. pppd wil...

CVE-2002-0542

mail in OpenBSD 2.9 and 3.0 processes a tilde escape character in a message even when it is not in interactive mode, which could allow local users to gain root privileges via calls to mail in cron...

CVE-2002-0557

Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, causes 1 rexec or 2 rsh to run another user's shell, or 3 atrun to change to a different user's directory, possibly due to memory allocation failures or an incorrect call to authapproval...

OpenBSD 3.1 sshd remote root exploit

Download openssh-3.2.2p1.tar.gz and untar it $ tar -xvzf openssh-3.2.2p1.tar.gz 2. Apply the patch provided below by running: /openssh-3.2.2p1 $ patch pathtodifffile 3. Compile the patched client /openssh-3.2.2p1 $ ./configure && make ssh 4. Run the evil ssh: /openssh-3.2.2p1 $ ./ssh...

Remote buffer overflow in resolver code of libc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ----------------------------------------------------------------------------- Pine Internet Security Advisory ----------------------------------------------------------------------------- Advisory ID : PINE-CERT-20020601 Authors : Joost Pol...

Re: Another flaw in Apache?

Further investigation show that the flaw is not in Apache itself, but in modssl, so it's probably not an OpenBSD-specific bug. It's just not triggered on systems where modssl isn't compiled in. The overflow is the sslcompatdirective function in src/modules/ssl/sslenginecompat.c . -- /- Frank DENI...

Another flaw in Apache?

Hello. While playing with the SetEnv directive with Apache, I noticed that httpd processes are dying with a signal 11 if the data stored in an environment variable was too long. I simply triggered the bug by creating a .htaccess file so a regular user can do it with : SetEnv DATELOCALE "..." The...

Apache 1.x2.0.x - Chunked-Encoding Memory Corruption (1)

Apache 1.x2.0.x - Chunked-Encoding Memory Corruption 1 // source: https://www.securityfocus.com/bid/5033/info When processing requests coded with the 'Chunked Encoding' mechanism, Apache fails to properly calculate required buffer sizes. This is believed to be due to improper signed interpretatio...

CVE-2002-0557

OpenBSD 3.0 vulnerability when using NIS/YP with netgroups in the password database can allow rexec or rsh to run another user’s shell, or atrun to switch to a different user’s directory, possibly due to memory allocation failures or an incorrect call to auth_approval(). No remediation details ar...

CVE-2002-0557

Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, causes 1 rexec or 2 rsh to run another user's shell, or 3 atrun to change to a different user's directory, possibly due to memory allocation failures or an incorrect call to authapproval...

CVE-2002-0514

PF in OpenBSD 3.0 with the return-rst rule sets the TTL to 128 in the RST packet, which allows remote attackers to determine if a port is being filtered because the TTL is different than the default TTL...

CVE-2002-0514

OpenBSD 3.0 PF with the return-rst rule is vulnerable. The RST packet’s TTL is set to 128, allowing remote attackers to infer whether a port is filtered by comparing TTL to the default. Affected component: PF rule handling in OpenBSD 3.0. Root cause: TTL manipulation in RST responses leads to dis...