OpenBSD Kernel mbuf Handling Buffer Overflow Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1017735
|
|
SecurityTracker URL: http://securitytracker.com/id?1017735
|
|
CVE Reference: CVE-2007-1365
(Links to External Site)
|
Updated: Mar 21 2007
|
Original Entry Date: Mar 7 2007
|
Impact: Execution of arbitrary code via network, Root access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: CORE
|
Version(s): 3.9, 4.0
|
Description: A vulnerability was reported in OpenBSD. A remote user can execute arbitrary code on the target system.
The kernel mbuf handling of ICMPv6 packets contains a buffer overflow. A remote user can send a specially crafted IPv6 fragment
to execute arbitrary code on the target system with kernel level privileges.
Default configurations are affected.
The vendor
was notified on February 20, 2007.
Alfredo Ortega from Core Security Technologies discovered this vulnerability.
The original
advisory is available at:
http://www.coresecurity.com/?action=item&id=1703
|
Impact: A remote user can execute arbitrary code with kernel level privileges.
[Editor's note: The vendor originally reported this vulnerability
as having a denial of service impact and the fix as being a reliability fix. Later, the vendor retracted the statement.]
|
Solution: The vendor has issued the following patches.
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/020_m_dup1.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common
/010_m_dup1.patch
The patches were revised on March 17, 2007. However, the patch URLs were not changed.
|
Vendor URL: www.openbsd.org/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: UNIX (OpenBSD)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 7 Mar 2007 17:18:00 -0500
Subject: OpenBSD kernel
|
RELIABILITY FIX: March 7, 2007 All architectures
Incorrect mbuf handling can crash machine.
A source code patch exists which remedies this problem.
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/020_m_dup1.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/010_m_dup1.patch
|
|
