OpenBSD systrace systrace_preprepl本地整数溢出漏洞

OpenBSD是一款开放源代码Unix类操作系统，OpenBSD的systrace功能可以允许或拒绝被管理进程所执行的syscall。 systrace的内核组件中存在整数溢出漏洞，允许攻击者通过在systrace ioctl中指定很大的整数值触发这个漏洞，导致绕过安全检查、向任意内核地址越界写入空字节或读取内核内存块。 漏洞代码在systracepreprepl函数中： for i = 0, len = 0; i repl-strrnrepl; i++ len += repl-strroffleni; if repl-strroffleni == 0 continue; if...

CVE-2006-5218

Integer overflow in the systracepreprepl function STRIOCREPLACE in systrace in OpenBSD 3.9 and NetBSD 3 allows local users to cause a denial of service crash, gain privileges, or read arbitrary kernel memory via large numeric arguments to the systrace ioctl...

CVE-2006-5218

The CVE-2006-5218 entry describes an integer overflow in the systrace_preprepl function (STRIOCREPLACE) within the systrace component of OpenBSD 3.9 and NetBSD 3. This vulnerability can be triggered by large numeric arguments to the systrace ioctl, allowing local users to cause a denial of servic...

honeyd security advisory: remote detection

Honeyd Security Advisory 2006-001 ================================= Topic: Remote Detection Via Multiple Probe Packets Version: All versions prior to Honeyd 1.5 Severity: Identification of Honeyd installations allows an adversary to launch attacks specifically against Honeyd. No remote root explo...

CVE-2004-2012

The CVE-2004-2012 entry concerns the systrace_exit function in the systrace utility used on NetBSD-current (pre-April 16, 2004) and certain FreeBSD ports. The vulnerability arises because the code path does not verify the owner of the /dec/systrace connection before setting the effective user ID ...

CVE-2004-2012

The systraceexit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges...

CVE-2004-2012

The systraceexit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges...

NetBSD systrace privilege escalation

By using invalid handling of error condition it's possible to obtain superuser privileges...

NetBSD Security Advisory 2004-007: Systrace systrace_exit() local root

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2004-007 ================================= Topic: Systrace systraceexit local root Version: NetBSD-current: source prior to Apr 16, 2004 netBSD 2.0 branch: source prior to Apr 16, 2004 netBSD 1.6.2: not affected NetBSD 1.6.1: not affecte...

NetBSDFreeBSD Port Systrace 1.x - Exit Routine Access Validation Privilege Escalation

NetBSDFreeBSD Port Systrace 1.x - Exit Routine Access Validation Privilege Escalation // source: https://www.securityfocus.com/bid/10320/info A vulnerability has been reported that affects Systrace on NetBSD, as well as the FreeBSD port by Vladimir Kotal. The source of the issue is insufficient...

NetBSD/FreeBSD Port Systrace 1.x - Exit Routine Access Validation Privilege Escalation

// source: https://www.securityfocus.com/bid/10320/info A vulnerability has been reported that affects Systrace on NetBSD, as well as the FreeBSD port by Vladimir Kotal. The source of the issue is insufficient access validation when a systraced process is restoring privileges. This issue can be...

[Full-Disclosure] Advisory 04/2004: Net(Free)BSD Systrace local root vulnerabilitiy

e-matters GmbH www.e-matters.de -= Security Advisory =- Advisory: NetFreeBSD Systrace local root vulnerability Release Date: 2004/05/11 Last Modified: 2004/05/11 Author: Stefan Esser [email protected] Application: NetBSD with systrace support before 2004/04/09 FreeBSD with unofficial port by...

systrace.txt

systrace silently patches full local bypass vulnerability on Linux Introductory Note: I will not be replying to any posts in response to this mail, no matter how many times you intentionally misspell my name or attack me personally. Annoying me in an attempt to get me to release vulnerability...

Systrace 1.x - Local Policy Bypass

// source: https://www.securityfocus.com/bid/9998/info Systrace has been reported prone to a vulnerability that may permit an application to completely bypass a Systrace policy. The issue presents itself because Systrace does not perform sufficient sanity checks while handling a process that is...

Systrace 1.x - Local Policy Bypass

Systrace 1.x - Local Policy Bypass // source: https://www.securityfocus.com/bid/9998/info Systrace has been reported prone to a vulnerability that may permit an application to completely bypass a Systrace policy. The issue presents itself because Systrace does not perform sufficient sanity checks...