valvoline's researching LABS.

home page

home
advisories
library
links
news
review
servizi
tools
freaknet.org
dyne.org
your account

.:::.search.:::.

.:::.who's online.:::.

There are currently, 1 guest(s) and 0 member(s) that are online.

..::lastest advisories::..

Lynx Command Line URL CRLF Injection Vulnerability

Microsoft Windows 2000 Subnet Bandwidth Manager RSVP Server Authority Hijacking Vulnerability

FreeBSD Ptrace/SPIgot Insufficient Signal Verification Denial of Service Vulnerability

Dotless IP Addresses Can Cause IE to Move into Intranet Zone

Invalid RDP Data can Cause Terminal Service Failure

phpBB Allows Remote Users to Modify Default SQL Queries

CDP Vulnerability in Cisco Routers

Hi-Resolution System`s MacAdministrator Hidden Files Disclosure and Access Vulnerability

TYPSoft FTP Server STOR/RETR Denial of Service Vulnerability

Security Bug Found in ht://Dig htsearch CGI (DoS, File Exposure)

Account Management Vulnerabilities in Ipswitch IMail Server

Cisco PIX Firewall Manager Password Disclosure Vulnerability

Atomz Search Engine Cross-site Scripting Vulnerability

Security Bug Found in PostNuke (and possibly PHPNuke

Additional Details Released on the Zone Spoofing Vulnerability

Ipswitch Web Calendaring Buffer Overflow

all advisories

..:::..lastest files..:::..

DNS Flood Detector v1.0

wormulon v0.1.3

ulogd-php v0.7

FWReport v1.1.5

Netl, a Customizable Low Level Network Monitor

WinDefender 2.1.6

NTDaddy, ASP Based Administration Kit

Virge v2.07

PCX Firewall v2.7

Port Scan Attack Detector (psad) v0.9.2

NARC v0.5.1

Nimda Notifyer v1.2

IIS Worms Detector v1.1

Legion of the Bouncy Castle Java Cryptography API v1.09

Samhain 1.2.8

all files

FreeBSD Ptrace/SPIgot Insufficient Signal Verification Denial of Service Vulnerability
posted by: valvoline on 15/08/2003 @ 12.04.17
additional: FreeBSD 4.2 / 4.3 / 4.4 / 4.5 / 4.6 / 4.7 / 4.8 / 5.0 / 5.1

summary:
A vulnerability has been discovered within the FreeBSD ptrace() system call and the spigot device driver. The issue exists due to the said components failing to carry out sufficient sanity checks when handling signal numbers.

As a result of this design error, it is possible to pass a negative signal number to one of the vulnerable pieces of code, which will effectively result in an out-of-bounds or negative signal being delivered by the mechanism. This will typically result in an assertion failure or system panic, causing the system to crash.

This issue could be exploited by an unprivileged attacker to crash a system to which they have local access. It should be noted that under default FreeBSD 5.x kernels, it may be possible for an attacker to exploit this issue in such a way as to execute arbitrary code with root privileges.

vulnerable FreeBSD FreeBSD 4.2
FreeBSD FreeBSD 4.3
FreeBSD FreeBSD 4.4
FreeBSD FreeBSD 4.5
FreeBSD FreeBSD 4.6
FreeBSD FreeBSD 4.7
FreeBSD FreeBSD 4.8
FreeBSD FreeBSD 5.0
FreeBSD FreeBSD 5.1

Workaround:
To avoid complete system compromise of this vulnerability on FreeBSD 5.x systems, it is advised that users uncomment or add the `INVARIANTS` line to their kernel configuration file, and recompile the kernel.

Solution:

FreeBSD has released patches to address this issue in affected releases. Users are advised to apply the patches as soon as possible. After applying the following patches, the FreeBSD kernel must be recompiled for the changes to take affect.

Please see the attached advisory for further details on the specific FreeBSD versions applicable to each patch.

FreeBSD FreeBSD 4.3:

FreeBSD Patch signal47.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-03:09/signal47.patch

FreeBSD FreeBSD 4.4:

FreeBSD Patch signal47.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-03:09/signal47.patch

FreeBSD FreeBSD 4.5:

FreeBSD Patch signal47.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-03:09/signal47.patch

FreeBSD FreeBSD 4.6:

FreeBSD Patch signal47.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-03:09/signal47.patch

FreeBSD FreeBSD 4.7:

FreeBSD Patch signal4s.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-03:09/signal4s.patch

FreeBSD Patch signal47.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-03:09/signal47.patch

FreeBSD FreeBSD 4.8:

FreeBSD Patch signal4s.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-03:09/signal4s.patch

FreeBSD FreeBSD 5.0:

FreeBSD Patch signal50.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-03:09/signal50.patch

FreeBSD FreeBSD 5.1:

FreeBSD Patch signal51.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-03:09/signal51.patch

comments: (0) |