CVE-2006-1588

CVE-2006-1588 affects NetBSD 1.6 to 3.0 where the bridge ioctl (if_bridge code) does not clear sensitive memory before copying ioctl results to the requesting process. This can allow local users to obtain portions of kernel memory. The vulnerability is described in multiple sources (NVD, CVE reco...

CVE-2006-1589

The elfloadfile function in NetBSD 2.0 through 3.0 allows local users to cause a denial of service kernel crash via an ELF interpreter that does not have a PTLOAD section in its header, which triggers a null dereference...

CVE-2006-1587

CVE-2006-1587 affects NetBSD 1.6–3.0. When a user has “set record” in .mailrc and the default umask, the created record file has 0644 permissions, allowing local users to read it. The connected documents confirm the vulnerable behavior and impact; no explicit exploitation details or remediation a...

CVE-2006-1588

The bridge ioctl ifbridge code in NetBSD 1.6 through 3.0 does not clear sensitive memory before copying ioctl results to the requesting process, which allows local users to obtain portions of kernel memory...

CVE-2006-1589

The CVE-2006-1589 entry affects NetBSD 2.0 through 3.0, where the elf_load_file function is vulnerable. A local user can trigger a kernel crash (denial of service) by loading an ELF interpreter that lacks a PT_LOAD header, causing a null dereference. The available connected documents confirm the ...

CVE-2006-1587

NetBSD 1.6 up to 3.0, when a user has "set record" in .mailrc with the default umask set, creates the record file with 0644 permissions, which allows local users to read the record file...

[SA19464] NetBSD if_bridge Kernel Memory Disclosure Vulnerability

TITLE: NetBSD ifbridge Kernel Memory Disclosure Vulnerability SECUNIA ADVISORY ID: SA19464 VERIFY ADVISORY: http://secunia.com/advisories/19464/ CRITICAL: Less critical IMPACT: Exposure of sensitive information WHERE: Local system OPERATING SYSTEM: NetBSD 1.x http://secunia.com/product/255/...

NetBSD if_bridge information leak

ioctl call exposes content of uninitialized memory...

[SA19465] NetBSD mail Insecure Record File Creation

TITLE: NetBSD mail Insecure Record File Creation SECUNIA ADVISORY ID: SA19465 VERIFY ADVISORY: http://secunia.com/advisories/19465/ CRITICAL: Less critical IMPACT: Exposure of sensitive information WHERE: Local system OPERATING SYSTEM: NetBSD 1.x http://secunia.com/product/255/ DESCRIPTION: A...

NetBSD mail weak permissions

Record file is created workd-readable if set record is present in .mailrc...

Code injection

A "programming error" in fastipsec in FreeBSD 4.8-RELEASE through 6.1-STABLE and NetBSD 2 through 3 does not properly update the sequence number associated with a Security Association, which allows packets to pass sequence number checks and allows remote attackers to capture IPSec packets and...

CVE-2006-0905

A "programming error" in fastipsec in FreeBSD 4.8-RELEASE through 6.1-STABLE and NetBSD 2 through 3 does not properly update the sequence number associated with a Security Association, which allows packets to pass sequence number checks and allows remote attackers to capture IPSec packets and...

CVE-2006-0905

A "programming error" in fastipsec in FreeBSD 4.8-RELEASE through 6.1-STABLE and NetBSD 2 through 3 does not properly update the sequence number associated with a Security Association, which allows packets to pass sequence number checks and allows remote attackers to capture IPSec packets and...

CVE-2006-0905

The CVE-2006-0905 entry concerns a programming error in fast_ipsec on FreeBSD 4.8-RELEASE through 6.1-STABLE and NetBSD 2–3 that fails to properly update the Security Association sequence number. This flaw lets remote attackers bypass sequence-number checks, enabling interception of IPSec packets...

CVE-2006-0905

A "programming error" in fastipsec in FreeBSD 4.8-RELEASE through 6.1-STABLE and NetBSD 2 through 3 does not properly update the sequence number associated with a Security Association, which allows packets to pass sequence number checks and allows remote attackers to capture IPSec packets and...

Sendmail 8.13.6 release notes

8.13.6/8.13.6 2006/03/22 SECURITY: Replace unsafe use of setjmp3/longjmp3 in the server and client side of sendmail with timeouts in the libsm I/O layer and fix problems in that code. Also fix handling of a buffer in smsyslog which could have been used as an attack vector to exploit the unsafe...

CVE-2005-4733

CVE-2005-4733 concerns NetBSD: affected are NetBSD 2.0 before 20050316 and NetBSD-current before 20050112. The issue is a local DoS caused by calling the F_CLOSEM fcntl with a parameter value of 0, which can trigger an infinite loop and system hang. The connected documents confirm the affected ve...

CVE-2005-4733

NetBSD 2.0 before 20050316 and NetBSD-current before 20050112 allow local users to cause a denial of service infinite loop and system hang by calling the FCLOSEM fcntl with a parameter value of 0...

CVE-2005-4741

NetBSD 1.6, NetBSD 2.0 through 2.1, and NetBSD-current before 20051031 allows local users to gain privileges by attaching a debugger to a setuid/setgid PSUGID process that performs an exec without a reset of real credentials...

CVE-2005-4741

NetBSD is affected: versions 1.6, 2.0–2.1, and NetBSD-current before 20051031. The issue is a local privilege escalation: a debugger can attach to a setuid/setgid (P_SUGID) process that performs an exec without resetting real credentials. Root cause: lack of credential reset on exec for P_SUGID p...