DoS против OpenBSD

Система падает при большом числе ARP-запросов в секунду...

obsd_fun.c

"hello hello obsd team. my obsd box panics every few seconds. what the hell is wrong?" "oh ? really ? hmm...out of space in kmemmap ?" "YES. you know about this bug ?" "yes. some kiddo is running a DoS against your box. we fixed it in 2.7. the kernel runs out of memory if you flood it with...

Re: OpenBSD Security Advisory

Hi, Here is another exploit for an application fstat that OpenBSD's format string audit has seemingly forgotten about. What I would like to know is why this and a number of other privileged applications have security vulnerabilities in them. They WERE fixed, but NO ADVISORY nor ANY MENTION IN THE...

OpenBSD 2.x - Pending ARP Request Remote Denial of Service

// source: https://www.securityfocus.com/bid/1759/info OpenBSD is vulnerable to a remotely exploitable denial of service condition. The problem seems to be a lack of limits on the storage of pending arp requests, and a failure to handle the condition of too many. If an attacker somehow causes a...

OpenBSD 2.x - Pending ARP Request Remote Denial of Service

OpenBSD 2.x - Pending ARP Request Remote Denial of Service // source: https://www.securityfocus.com/bid/1759/info OpenBSD is vulnerable to a remotely exploitable denial of service condition. The problem seems to be a lack of limits on the storage of pending arp requests, and a failure to handle t...

Дырка в OpenBSD (fstat, talkd)

Ошибки форматной строки...

OpenBSD 2.x - fstat Format String

OpenBSD 2.x - fstat Format String // source: https://www.securityfocus.com/bid/1746/info fstat is a program shipped with BSD unix variants that is used to list the open files on a system. It is installed sgid kmem so it can access information about open files from the kernel memory structures. A...

OpenBSD 2.x - 'fstat' Format String

// source: https://www.securityfocus.com/bid/1746/info fstat is a program shipped with BSD unix variants that is used to list the open files on a system. It is installed sgid kmem so it can access information about open files from the kernel memory structures. A user definable environment variabl...

DoS против OpenBSD

Пустой пакет протоколов AH и ESP вызывает ошибку в ядре при включенной поддержке IPSec...

Nmap Protocol Scanning DoS against OpenBSD IPSEC

The protocol scanning option -sO in 2.54 Beta releases of nmap results in a remote denial of service against OpenBSD 2.7's IPSEC implementation due to its inability to handle tiny AH/ESP packets. Nmap protocol scans repeatedly cycle through IP protocol version numbers, attempting to elicit ICMP...

Format strings: bug #1: BSD-lpr

Hi, INTRO ----- Welcome to a short series of security bugs, all involving mistakes with "user supplied format strings". This class of bug is very popular on Bugtraq at the moment, so what an ideal time for a few examples. BSD-lpr ------- If we look into lpr/lpd/printjob.c, we can find the followi...

Gert Doering mgetty 1.1.19/1.1.20/1.1.21/1.22.8 - Symbolic Link Traversal

source: https://www.securityfocus.com/bid/1612/info A vulnerability exists in a portion of the mgetty package, by Gert Doering. By exploiting a flaw in the faxrunq and faxrunqd programs, it is possible for local users to create arbitrary files, and alter arbitrary files on the filesystem. This in...

David Bagley xlock 4.16 - User Supplied Format String (1)

// source: https://www.securityfocus.com/bid/1585/info A vulnerability exists in versions of the xlockmore program, originally written by David Bagley. It is believed to affect all versions of xlock derived from xlockmore. This includes the xlock shipped with a number of popular operating systems...

David Bagley xlock 4.16 - User Supplied Format String (1)

David Bagley xlock 4.16 - User Supplied Format String 1 // source: https://www.securityfocus.com/bid/1585/info A vulnerability exists in versions of the xlockmore program, originally written by David Bagley. It is believed to affect all versions of xlock derived from xlockmore. This includes the...

OpenBSD 2.7 / NetBSD 1.4.2 mopd buffer overflow

The mopd Maintenance Operations Protocol loader daemon implementation in OpenBSD 2.7 and NetBSD 1.4.2 includes a step in which the daemon receives a file name from a client elsewhere on the network. I found one point at which the client can overflow a buffer in the server by sending a long file...

CVE-2000-0574

Affected software: OpenBSD ftpd, NetBSD ftpd, ProFTPd, and Opieftpd. The issue is that untrusted format strings are not properly cleansed in setproctitle, allowing remote attackers to cause a denial of service or execute arbitrary commands. The connected Nessus document notes an attack scenario w...

CVE-2000-0574

FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle function sometimes called by setproctitle, which allows remote attackers to cause a denial of service or execute arbitrary commands...

Удаленный root через ftpd в OpenBSD

Ошибка "форматной строки" полностью аналогичная ошибке в wu-ftpd...

Possible root exploit in ISC DHCP client.

Somebody at OpenBSD discovered a possible root exploit in the ISC DHCP client. This exploit is present in all versions of the ISC DHCP client prior to 2.0pl1 and 3.0b1pl14, which I just released this evening. Anybody who is using versions of the ISC DHCP client other than these is strongly urged ...

FreeBSD 3.x/4.0/5.0 / NetBSD 1.4.1/1.4.2 / OpenBSD 2.x - Denial of Service

// source: https://www.securityfocus.com/bid/1296/info A denial of service attack exists that affects FreeBSD, NetBSD and OpenBSD. It is believed that all versions of these operating systems are vulnerable. The vulnerability is related to setting socket options regarding the size of the send and...